CVE-2026-97928 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: skip the VMID 0 flush for VRAM
Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA flush can wedge the engine; only flush when a GART window is actually used.
v2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed, and drive the clear and copy paths from that. (Christian) v3: Make the vm_needs_flush output parameter mandatory instead of allowing NULL. (Christian)
(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's AMDGPU driver contains a logic flaw in the virtual memory management subsystem that can lead to hardware engine wedging on specific GPU architectures, particularly those based on the GFX11 architecture such as Navi33. The vulnerability arises during buffer mapping operations where video RAM is accessed via direct Memory Controller addresses rather than through a Graphics Address Remapping Table window. In these scenarios, the driver incorrectly triggers a Virtual Machine ID zero flush operation even though no GART translation is involved. This unnecessary hardware command results in an SDMA engine stall that can permanently freeze the graphics processing unit, causing system instability or requiring a hard reset to recover functionality.
From a technical perspective, this issue stems from the amdgpu_ttm_map_buffer function which handles buffer mapping for TTM memory management. The clear-on-release mechanism is designed to wipe VRAM contents before release but was implemented without distinguishing between direct MC address access and GART-based access paths. When operating on GFX11 hardware, forcing a VMID zero flush during these specific operations causes the SDMA engine to hang because it expects valid context state that does not exist in this particular execution path. The root cause is classified under CWE-841 Improper Enforcement of Behavioral Restrictions as the driver fails to properly enforce architectural constraints regarding when certain hardware commands are safe to execute based on memory mapping type.
The operational impact includes denial of service through GPU hang, which affects all applications relying on AMDGPU acceleration including desktop environments, gaming workloads, and compute tasks. Users may experience screen freezes, unresponsive input devices, or complete system lockups requiring power cycling. This vulnerability specifically impacts systems utilizing RDNA 3 architecture GPUs where the SDMA engine behavior differs from previous generations regarding VMID flush requirements during buffer mapping operations without GART involvement.
Mitigation strategies involve applying kernel updates that include the fix for this specific commit which modifies amdgpu_ttm_map_buffer to return a boolean indicating whether VMID zero flushing is actually required based on whether a GART window was programmed. System administrators should ensure their Linux kernels are updated to versions containing this patch, typically available through distribution security repositories or by compiling from upstream stable kernel sources that have incorporated the cherry-picked commit. Additionally, monitoring system logs for SDMA engine hang messages can help identify affected systems before complete failure occurs.
This vulnerability aligns with ATT&CK technique T1499 Endpoint Denial of Service as it enables an attacker to cause resource exhaustion or unavailability through improper hardware command execution. The fix ensures that VMID flush operations are only performed when necessary for GART-based memory mappings, preserving engine state integrity and preventing spurious SDMA commands from causing architectural stalls on modern AMD GPU architectures.