Executive brief
A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to crash the entire system. By submitting specially crafted requests to the graphics hardware, an unprivileged user can trigger a fatal kernel error (panic). This results in a complete denial of service, requiring a system reboot and potentially interrupting ongoing operations.
Technical details
The vulnerability exists in the sdma_v4_0_ring_emit_fence() function within the AMDGPU driver (SDMA v4.0). The function contained BUG_ON() assertions that checked for dword-alignment of fence writeback addresses. These assertions were reachable from unprivileged userspace via crafted DRM_IOCTL_AMDGPU_CS submissions. When a misaligned address is provided, the BUG_ON() macro triggers a fatal kernel panic in a scheduler worker thread. The fix replaces these assertions with WARN_ON() to prevent system crashes and suggests that validation should occur earlier in the IOCTL path.
Affected products
- Linux Linux Kernel SDMA v4.0 implementation
Timeline
- 2026-05-28: advisory: NVD publication date
- 2026-05-28: patched: Patches merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/0b91ea46bb68abf98a082bf239092253bbd6aaa2
- https://git.kernel.org/stable/c/4f7ca00fa91daf0795ec6b3b130c5ebba1f155fe
- https://git.kernel.org/stable/c/78d2e624fa073c14970aa097adcf3ea31c157a66
- https://git.kernel.org/stable/c/a4fd82fb0757c180bf622907397c528b89a827b2
- https://git.kernel.org/stable/c/d331fb241a4602253976ddd65144a8ba2b05665d