CVE-2026-89808

drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up.

Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0.

Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before d5872c81c70163a3ba9eb4da9a94c92b03067576Affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before 6e1a6f3ddb87d7f89a775c55fb399680c02bdcc2Affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before bd1adb2e5101db649121b59e601c92773a302a70Affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before ae806a95b28fcecb913430cfa45a252e91a945d6Affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before 0a9a0e8a97da70a0336c9115178aaf1be29bcfb1Affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before 520e345ffe05aabef1db82beda4288afb1757ff2Affected
LinuxLinux	5.14Affected before 5.14Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before d5872c81c70163a3ba9eb4da9a94c92b03067576Affected
50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before 6e1a6f3ddb87d7f89a775c55fb399680c02bdcc2Affected
50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before bd1adb2e5101db649121b59e601c92773a302a70Affected
50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before ae806a95b28fcecb913430cfa45a252e91a945d6Affected
50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before 0a9a0e8a97da70a0336c9115178aaf1be29bcfb1Affected
50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 to before 520e345ffe05aabef1db82beda4288afb1757ff2Affected

LinuxLinux

5.14Affected
before 5.14Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.