{"id":"CVE-2026-89808","published":"2026-09-16T11:16:45.940","lastModified":"2026-09-17T10:17:03.883","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram\n\nWhen migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set +\nMIGRATE_PFN_VALID unset) driver still allocates device pages. There is no\ndma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart()\nwill return an uninitialized r. That can trigger out_free_vram_pages to drop\nall VRAM just set up.\n\nInitialize r and only call the last svm_migrate_copy_memory_gart if j > 0.\n\nCurrent code postponed the last page to the final copy. This patch flushes on\nthe last page when reach to the end of current drm_buddy_block; avoids another\nsvm_migrate_copy_memory_gart.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/0a9a0e8a97da70a0336c9115178aaf1be29bcfb1","tags":[]},{"url":"https://git.kernel.org/stable/c/520e345ffe05aabef1db82beda4288afb1757ff2","tags":[]},{"url":"https://git.kernel.org/stable/c/ae806a95b28fcecb913430cfa45a252e91a945d6","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}