Executive brief
A vulnerability in the Linux kernel's AMD GPU driver can cause a system crash on certain high-performance computing configurations. On systems using 64KB memory pages, a mismatch in how the driver reserves memory for hardware trap handlers leads to a kernel failure. This primarily impacts system availability for users running GPU-intensive diagnostic or unit testing tools.
Technical details
A NULL pointer dereference exists in the drm/amdgpu driver due to a hardcoded memory reservation size. AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, but on systems with 64KB page sizes, the KFD_CWSR_TBA_TMA_SIZE (defined as 2 * PAGE_SIZE) becomes 128KB. This mismatch between the reserved trap area and the actual allocation size causes a kernel crash (Oops) during memory allocation for the GPU virtual machine, specifically when running tools like rocminfo. The fix increases the reserved trap size to 64KB and aligns allocation constants with the GPU page size to ensure the allocation never exceeds the reserved area.
Affected products
- Linux Linux Kernel 6.9 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-05-01: advisory: Initial CVE publication
- 2026-03-30: patched: Fix committed to mainline kernel