Linux Kernel MES ring amdgpu_device_pre_asic_reset infinite loop

Summaryinfo

A vulnerability was found in Linux Kernel and classified as critical. Affected by this issue is the function amdgpu_device_pre_asic_reset of the component MES ring. Such manipulation leads to infinite loop. This vulnerability is documented as CVE-2026-89812. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in Linux Kernel (the affected version is unknown) and classified as critical. Affected by this issue is the function amdgpu_device_pre_asic_reset of the component MES ring. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1 reset, while fence_drv.sync_seq keeps advancing for every packet. When the reset is triggered because MES itself stopped responding, the timed-out packets advance sync_seq past the last hw fence value MES wrote. After resume the first MES submission polls forever on a seq that is never written back, failing the resume and wedging the box on a second reset: amdgpu: MES ring buffer is full. amdgpu: *ERROR* ring gfx_0.0.0 test failed (-110) amdgpu: resume of IP block <gfx_v11_0> failed -110 amdgpu: GPU reset end with ret = -110 Force complete the MES scheduler ring fences together with the scheduler rings so their hw fence is realigned to sync_seq. v2: cover all XCCs (one scheduler ring each), not just mes.ring[0].

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-89812 since 09/11/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/18/2026). This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Applying the patch ebe7542553d008e2285e0fbba0c63f0295a7e694 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3438). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion