CVE-2026-89808drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
- 7.8HighCVSS base score
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up. Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0. Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart.
Timeline
ID reserved
By Linux
- 5 days later
· 5 days later
Published
- 44 days later
· 44 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 – < d5872c81c70163a3ba9eb4da9a94c92b03067576
- affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 – < 6e1a6f3ddb87d7f89a775c55fb399680c02bdcc2
- affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 – < bd1adb2e5101db649121b59e601c92773a302a70
- affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 – < ae806a95b28fcecb913430cfa45a252e91a945d6
- affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 – < 0a9a0e8a97da70a0336c9115178aaf1be29bcfb1
- affected 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 – < 520e345ffe05aabef1db82beda4288afb1757ff2
- affected 5.14
- unaffected < 5.14
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.51 – ≤ 6.18.*
- unaffected 7.2.5 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/d5872c81c70163a3ba9eb4da9a94c92b03067576 (opens in a new tab)
- https://git.kernel.org/stable/c/6e1a6f3ddb87d7f89a775c55fb399680c02bdcc2 (opens in a new tab)
- https://git.kernel.org/stable/c/bd1adb2e5101db649121b59e601c92773a302a70 (opens in a new tab)
- https://git.kernel.org/stable/c/ae806a95b28fcecb913430cfa45a252e91a945d6 (opens in a new tab)
- https://git.kernel.org/stable/c/0a9a0e8a97da70a0336c9115178aaf1be29bcfb1 (opens in a new tab)
- https://git.kernel.org/stable/c/520e345ffe05aabef1db82beda4288afb1757ff2 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-80408 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89808)Record last updated .