CVE-2026-89811

drm/amdkfd: Add TLB flush after MES queue eviction/suspension

State: Published
Severity: 8.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Add TLB flush after MES queue eviction/suspension

MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race condition where in-flight DMA descriptors can access memory that has been unmapped, leading to page faults and GPU queue hangs during SVM page migration.

The issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest failures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU compute queue hangs with packets submitted but never consumed.

Add kfd_flush_tlb() calls after MES queue removal in two locations: - evict_process_queues_cpsch(): after all queues removed during eviction - suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)

This ensures all in-flight memory accesses from unmapped queues are flushed before memory is freed or migrated.

(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cc009e613de6560eb499f8bc92c80a737752cb30 to before 750cd793ee69c27faf17fb9c49f92f71716bbc8bAffected cc009e613de6560eb499f8bc92c80a737752cb30 to before 5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1Affected cc009e613de6560eb499f8bc92c80a737752cb30 to before bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372Affected cc009e613de6560eb499f8bc92c80a737752cb30 to before e230c546ed93741833ab5babb0b202f9c2052b45Affected cc009e613de6560eb499f8bc92c80a737752cb30 to before 6aae545c87087e4dc96e205452243813bfa73ba2Affected cc009e613de6560eb499f8bc92c80a737752cb30 to before 94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

cc009e613de6560eb499f8bc92c80a737752cb30 to before 750cd793ee69c27faf17fb9c49f92f71716bbc8bAffected
cc009e613de6560eb499f8bc92c80a737752cb30 to before 5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1Affected
cc009e613de6560eb499f8bc92c80a737752cb30 to before bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372Affected
cc009e613de6560eb499f8bc92c80a737752cb30 to before e230c546ed93741833ab5babb0b202f9c2052b45Affected
cc009e613de6560eb499f8bc92c80a737752cb30 to before 6aae545c87087e4dc96e205452243813bfa73ba2Affected
cc009e613de6560eb499f8bc92c80a737752cb30 to before 94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.