CVE-2026-98894

drm/amd/ras: reset CPER ring on corrupt entry size

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 26, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/ras: reset CPER ring on corrupt entry size

When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance rptr after dword conversion and pointer masking.

In that case the recovery loop keeps testing the same location while holding the CPER ring mutex. This can hang the worker that is writing the next CPER record.

Detect a no-progress rptr update and reset the CPER ring to an empty state instead. This drops the corrupt contents and lets the writer leave the recovery path without spinning.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 4058e7cbfd0fb0cae7cbb8035bb43c593cc7c964 to before a98d0d49757a113ce17960262b9cd4ccc1420108Affected
  • 4058e7cbfd0fb0cae7cbb8035bb43c593cc7c964 to before 4d695e66d7027a0c78302e47ac76293675fbbb4dAffected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.