CVE-2026-89808drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up. Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0. Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 before ae806a95b28fcecb913430cfa45a252e91a945d6; 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 builds before 0a9a0e8a97da70a0336c9115178aaf1be29bcfb1; from 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 before 520e345ffe05aabef1db82beda4288afb1757ff2 | CNA record |
References
- https://git.kernel.org/stable/c/ae806a95b28fcecb913430cfa45a252e91a945d6
- https://git.kernel.org/stable/c/0a9a0e8a97da70a0336c9115178aaf1be29bcfb1
- https://git.kernel.org/stable/c/520e345ffe05aabef1db82beda4288afb1757ff2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.