HIGH Introduced in 5.14
amdkfd VramMigration Corruption
CVE-2026-89808
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up. Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0. Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart.
02KernelScan AI Analysis
Risk summary
A local user with access to an AMD GPU can trigger a memory migration path where an uninitialized return value causes the driver to erroneously free VRAM pages that were just allocated, leading to GPU memory corruption. This can result in information disclosure, data integrity violations, or system instability. Systems running untrusted GPU workloads or sharing a GPU among multiple tenants are at highest risk.
Vulnerability analysis
When migrating CPU memory to GPU VRAM, the AMD KFD driver does not properly handle virtual memory ranges that are holes — pages flagged for migration but not valid. In this situation the driver allocates VRAM pages but performs no actual data copy, leaving the function's return value uninitialized on the stack. If that uninitialized value happens to be non-zero, the error cleanup path fires and frees all VRAM pages that were just set up, corrupting the GPU memory manager's state and potentially affecting other GPU contexts that reference those pages. The fix initializes the return value to zero so the normal path is taken when no error occurred, and skips the final copy operation entirely when no pages were accumulated. This path is reachable by any local user with access to an AMD GPU device through the shared virtual memory migration interface; no root privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.14 | 6.12.114 | bd1adb2e5101 |
| 6.18 | 5.14 | 6.18.51 | ae806a95b28f |
| 6.6 | 5.14 | 6.6.160 | 6e1a6f3ddb87 |
| 7.2 | 5.14 | 7.2.5 | 0a9a0e8a97da |
| mainline | 5.14 | 7.3 | 520e345ffe05 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |