Executive brief
A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when parent and child processes attempt to access the same graphics memory resources simultaneously after a process split (fork). This race condition can lead to memory corruption, impacting the stability and security of systems using AMD graphics hardware.
Technical details
A use-after-free vulnerability exists in the amdgpu driver (specifically within the KFD GPUVM component) due to a race condition in VM acquisition. The root cause is a non-atomic assignment to 'vm->process_info' in 'init_kfd_vm'. When parent and child processes share a 'drm_file' and both attempt to acquire the same VM after a fork() call, the lack of synchronization allows for concurrent access. An attacker with local access can exploit this race to trigger memory corruption. The fix replaces the non-atomic assignment with a 'cmpxchg()' operation to ensure atomic updates and prevent multiple processes from acquiring the same VM simultaneously.
Affected products
- Linux Linux Kernel amdgpu driver
Timeline
- 2026-02-05: other: Patch authored by AMD
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2c1030f2e84885cc58bffef6af67d5b9d2e7098f
- https://git.kernel.org/stable/c/46d309996bd9251792d7dafdbaf615cf202b4447
- https://git.kernel.org/stable/c/7885eb335d8f9e9942925d57e300a85e3f82ded4
- https://git.kernel.org/stable/c/904025fa8bba1d028adade33346372b4ac1a9249
- https://git.kernel.org/stable/c/94b7782d0c8024f5b88454241c8d4777076c3786
- https://git.kernel.org/stable/c/ae87aea330c24f462fc7058ed543ba8bc6798447
- https://git.kernel.org/stable/c/c658c1c85ec235b7ecfbf8dbfee385b1332088f4