CVE-2026-89810 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general.
The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's Direct Rendering Manager subsystem for AMD kernels features a component known as amdkfd, which manages the heterogeneous computing capabilities of AMD GPUs through their Heterogeneous System Memory (HSM) architecture. This architecture allows the GPU and CPU to share physical memory pages, facilitating efficient data transfer between processing units without requiring explicit copying in many scenarios. A critical aspect of this system is page migration, where memory pages are moved between device-local memory and system RAM depending on access patterns and resource availability. The vulnerability identified resides within the error handling path of the svm_migrate_copy_to_ram function, which is responsible for migrating data from GPU device memory back to system random-access memory when requested by a process or driver routine.
The core technical flaw involves an incorrect method used to identify and release allocated system pages during failure scenarios. When page migration fails due to hardware errors, resource exhaustion, or other transient conditions, the driver must properly clean up by releasing and unlocking the previously allocated system RAM pages. The correct procedure requires converting a physical frame number (PFN) into a struct page pointer using standard kernel APIs such as pfn_to_page. However, the vulnerable implementation incorrectly utilized DMA addresses associated with the AMD device context to perform these operations. This approach is fundamentally flawed because DMA addresses are bus-specific mappings that do not directly correspond to the logical or physical memory structures managed by the Linux kernel's buddy allocator and page management subsystems.
This discrepancy becomes particularly severe when an IOMMU (Input-Output Memory Management Unit) is enabled in the system configuration. An IOMMU translates device-visible virtual addresses into physical host memory addresses, meaning that a DMA address observed by the GPU driver does not necessarily match the underlying physical frame number or the kernel's internal page representation. Even without an IOMMU, relying on DMA addresses for general-purpose page management is incorrect practice within the Linux kernel architecture. By using invalid pointers derived from these mismatched addresses, the code attempts to access memory structures that do not correspond to the allocated system pages. This leads to undefined behavior, potentially resulting in use-after-free conditions, corruption of internal kernel data structures, or a complete system crash via a null pointer dereference or general protection fault.
The operational impact of this vulnerability is significant for systems relying on AMD GPUs with HSA support. If an application triggers page migration that subsequently fails, the improper cleanup routine can destabilize the entire operating system. In worst-case scenarios, attackers who can induce repeated migration failures might exploit these memory corruption issues to achieve arbitrary code execution or escalate privileges by corrupting kernel heap structures. Furthermore, even without malicious intent, normal workload variations involving heavy GPU-CPU data sharing could trigger this bug under specific failure conditions, leading to unpredictable system instability and service interruptions for critical workloads such as machine learning training, scientific simulations, or high-performance computing tasks that depend on stable memory management.
From a standards perspective, this vulnerability aligns with CWE-416, Use After Free, due to the potential access of invalid memory structures during cleanup. It also relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, if the corruption leads to information leakage through kernel memory dumps or crash logs containing sensitive data layouts. In terms of the MITRE ATT&CK framework for enterprise security, this flaw could be leveraged in techniques associated with Defense Evasion by causing system instability to disrupt monitoring tools, or potentially Privilege Escalation via exploitation of kernel memory corruption vulnerabilities like CVE-2016-8655 style bugs. The lack of proper validation and incorrect pointer arithmetic represents a classic class of errors often found in low-level driver development where assumptions about hardware address spaces are incorrectly mapped to software abstractions.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that corrects the error path logic. This fix ensures that upon migration failure, the driver correctly retrieves the struct page pointers using valid physical frame numbers rather than DMA addresses. The corrected code properly calls dma_unmap on the system RAM pages and releases them through standard kernel interfaces like put_page or __free_pages, ensuring reference counts are managed accurately. System administrators should ensure their kernels are updated to versions containing this fix. For environments where immediate patching is not feasible, limiting GPU memory usage patterns that trigger frequent migrations may reduce exposure risk, though complete mitigation requires the code correction since any migration failure could theoretically be triggered by legitimate application behavior or resource pressure conditions inherent in multi-tenant systems.