Executive brief
A vulnerability in the Linux kernel's AMD GPU driver can allow a local user to cause a denial-of-service condition. By triggering a specific memory allocation failure, an attacker can cause the system to leak internal locks, effectively freezing GPU-related tasks. This can result in the affected process becoming unkillable and may require a system reboot to restore full functionality.
Technical details
A vulnerability exists in the AMDGPU driver within the Linux kernel's amdgpu_gem_op_ioctl() function. When the AMDGPU_GEM_OP_GET_MAPPING_INFO operation is requested, the driver acquires several resources, including a drm_gem_object reference and multiple drm_exec locks. If a subsequent kvcalloc() call fails due to memory exhaustion (ENOMEM), the function returns immediately without releasing these resources. This results in a persistent lock leak on the per-process VM root page directory. An unprivileged local attacker with access to the render node (/dev/dri/renderD*) can exploit this to hang GPU contexts, leading to tasks entering an uninterruptible sleep state (D state) that persists until a reboot. The issue has been resolved by ensuring the failure path routes through the proper cleanup labels.
Affected products
- Linux Linux Kernel 4d82724f7f2b to 1eb86334e391695d4a40743b114afc15df4dc506
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory