Executive brief
The Linux kernel's AMD GPU driver contains overly aggressive error handling in its SDMA (Scalable Data Movement Architecture) fence logic. When certain alignment conditions are violated during GPU memory operations, the kernel crashes entirely instead of logging a warning and continuing. This allows a local user to trigger an unexpected system shutdown by manipulating GPU command submissions.
Technical details
The vulnerability exists in the drm/amdgpu/sdma_v4_4_2.c driver where BUG_ON() assertions check for 4-byte alignment of memory addresses in the sdma_v4_4_2_ring_emit_fence() function. BUG_ON() unconditionally crashes the kernel when its condition is true, whereas the intent of these checks is to detect anomalies and warn—not terminate. The affected code does not require special privileges or authentication; a local user with GPU access can craft malicious SDMA commands that violate the alignment constraint. The fix replaces BUG_ON() with WARN_ON(), which logs the violation and allows normal operation to continue. Patches are available in kernel commit 40cdbe9fa424cc6264a7aed93a04bd7d69109d9e and later stable releases.
Affected products
- Linux Linux kernel multiple stable versions (exact range not specified in advisory)
Timeline
- 2026-08-10: disclosed: CVE-2026-68110 published
- 2026-06-15: patched: Fix authored by Alex Deucher
- 2026-08-03: patched: Fix merged to stable kernel tree