EUVD-2026-80410
GHSA-xrq7-rc4j-2cmm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local KFD compute user (PR:L); AC:H because only the migration-failure error path with IOMMU enabled is reachable; wrong-page release/UAF-class corruption supports C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general.
The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path.
AnalysisAI
Memory corruption in the Linux kernel's AMD KFD (amdkfd) driver allows a local user with access to the GPU compute interface to corrupt kernel page state when a GPU Shared Virtual Memory (SVM) page migration from device memory to system RAM fails. The error-path cleanup derives the struct page from a DMA/bus address instead of the page's physical address (pfn), so on systems with an enabled IOMMU it releases and unlocks system-RAM pages that the migration never pinned, while the genuinely allocated pages are leaked and their DMA mappings are not torn down correctly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a system running the AMD KFD (amdkfd) driver with GPU Shared Virtual Memory (SVM) migration in use - typically ROCm/HSA compute workloads - AND an enabled IOMMU, which is the precise condition under which the DMA (bus) address diverges from the physical address so the wrong struct page is resolved. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is a local-privilege full-triad memory-corruption score, but the description shows the bug is reachable only on the error path of svm_migrate_copy_to_ram - the device-to-system-RAM migration must actually FAIL before the faulty cleanup runs, which realistically warrants AC:H rather than AC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch: update the Linux kernel to 6.18.51, 7.2.5 or later (the fix also lands in 7.3-rc1), or backport upstream commits da87bcad1f781d822e7ced6d1de9dbc6d381c72e, a2035918a7a1d8fd3bb79d22e1e149294a5a8418 and 960c4a8069bfd352c48cc88592618f1ebe24c69e as listed in the kernel stable references and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-89810; distribution kernels must ship their own rebuilt packages, since the fix is in-tree rather than in a separately versioned driver. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with AMD GPUs used for ROCm/HSA compute workloads, especially those with IOMMU enabled, and restrict local access to the GPU compute interface to trusted personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today