EUVD-2026-80410

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svmmigratecopytoram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn,...

CVE-2026-89810 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svmmigratecopytoram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn,...

CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89809

CVE-2026-89809 is a NULL pointer dereference in the Linux kernel's AMD KFD driver (drm/amdkfd). The bug is in the pqm_debugfs_mqds function: a for-loop calling mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. When a process holds a KF...

EUVD-2026-80409

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89808

CVE-2026-89808 affects the Linux kernel 's drm/amdkfd driver (AMD KFD). The root cause is an unhandled case in svm_migrate_copy_to_vram where the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocates device pages without a vali...

CVE-2026-89808 drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

EUVD-2026-80408

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89808 drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

EUVD-2026-80407

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89807

A NULL pointer dereference in the Linux kernel's drm/amdkfd driver allows a local user holding CAP_CHECKPOINT_RESTORE to panic the machine. Both create_queue_cpsch() and create_queue_nocpsch() call mqd_mgr->restore_mqd() unconditionally during CRIU restore, with no NULL guard. When restore_mqd...

CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89811: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

PT-2026-93449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the driver allocates device pages even when the migration virtual memory range is a hole on the CPU side specifically when MIGRATE PFN...

PT-2026-93451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component during page migration from a device to system RAM. When migration fails, the driver incorrectly uses the DMA address instead of the page...

CVE-2026-89808: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

Linux Distros Unpatched Vulnerability : CVE-2026-89808

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset...

Linux Distros Unpatched Vulnerability : CVE-2026-89810

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix error path at svmmigratecopytoram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated syst...