Executive brief
A vulnerability in the Linux kernel's AMD graphics driver could allow a local user to cause a system deadlock or crash. The issue stems from improper internal locking and memory management when the system attempts to read hardware registers. This could lead to a denial-of-service, impacting the availability of systems using AMD GPUs.
Technical details
Multiple race conditions and locking issues exist in the AMDGPU driver's 'AMDGPU_INFO_READ_MMR_REG' IOCTL implementation within 'amdgpu_kms.c'. Specifically, the code incorrectly called 'copy_to_user' while holding a lock, performed memory allocation while holding the reset semaphore (risking deadlock), and used 'down_read_trylock' instead of properly waiting for hardware resets to complete. An attacker with local access to the GPU device could trigger these conditions to cause a kernel deadlock or crash. The vulnerability has been addressed by reordering lock acquisitions and ensuring memory allocations occur outside of critical sections.
Affected products
- Linux Linux 6.6.55 to 6.6.141, 6.10.14 to 6.11, 6.11.3 to 6.12, 6.12, 6.18.33, 7.0.10
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory
References
- https://git.kernel.org/stable/c/0ef196a208385b7d7da79f411c161b04e97283e2
- https://git.kernel.org/stable/c/5c29d20470d4566d1b68df57097d642d01f8b427
- https://git.kernel.org/stable/c/61957c2e467b39b528a290016367d32a433fa846
- https://git.kernel.org/stable/c/8c4254c8f5836e77ae83e7fc037f02b69f7a0977
- https://git.kernel.org/stable/c/a31c3feb54b15a90232e497ad0e27e8a82052d8d