HIGH Introduced in 5.14
amdkfd PageMigration UAF
CVE-2026-89810
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svm_migrate_copy_to_ram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general. The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path.
02KernelScan AI Analysis
Risk summary
A local user with access to an AMD GPU can trigger a page migration failure that causes the kernel driver to free and unlock the wrong memory pages, leading to kernel memory corruption. Systems with AMD GPUs and local unprivileged GPU users are at risk; appliances without interactive users or GPU access are not affected.
Vulnerability analysis
When the AMD GPU driver fails to migrate pages from device memory to system RAM, the error cleanup path mistakenly uses device bus addresses as if they were system memory locations to decide which pages to release. When an IOMMU is active, those bus addresses do not match the intended physical pages, so the driver unlocks and frees the wrong pages while the actual allocated pages and their mappings are left behind. This can corrupt kernel memory by releasing pages that are still in use elsewhere. The corrected code keeps direct references to the correct system pages throughout the operation and uses them during failure cleanup, ensuring every mapping is removed before its corresponding page is released. A local user with access to the AMD GPU through the compute driver can trigger this by causing a page migration to fail; no special privileges beyond standard GPU device access are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 5.14 | 7.3-rc1 | 960c4a8069bf |
| 7.2 | 5.14 | 7.2.5 | a2035918a7a1 |
| 6.18 | 5.14 | 6.18.51 | da87bcad1f78 |