CVE-2026-89810

drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general.

The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before ee007a238dd363ba2f3a3b01815703cfe98711c7Affected 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before 44cad7ea3532f14999008d899daacc4ce4b633bfAffected 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before 872b7427e64f3e84b16c62577cbf3cd09a3401a2Affected 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before da87bcad1f781d822e7ced6d1de9dbc6d381c72eAffected 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before a2035918a7a1d8fd3bb79d22e1e149294a5a8418Affected 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before 960c4a8069bfd352c48cc88592618f1ebe24c69eAffected
LinuxLinux	5.14Affected before 5.14Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before ee007a238dd363ba2f3a3b01815703cfe98711c7Affected
48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before 44cad7ea3532f14999008d899daacc4ce4b633bfAffected
48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before 872b7427e64f3e84b16c62577cbf3cd09a3401a2Affected
48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before da87bcad1f781d822e7ced6d1de9dbc6d381c72eAffected
48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before a2035918a7a1d8fd3bb79d22e1e149294a5a8418Affected
48ff079b28d82dbce000cc45c0fd35b6ae9ffbda to before 960c4a8069bfd352c48cc88592618f1ebe24c69eAffected

LinuxLinux

5.14Affected
before 5.14Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.