Executive brief
AMD GPU driver logic in the Linux kernel can trigger a kernel crash when the graphics device fails to initialize or is removed. The issue occurs because memory regions are released in the wrong order, causing the driver to attempt accessing already-freed memory. This results in a kernel page fault that can cause system instability or denial of service on systems with AMD Radeon GPUs.
Technical details
The vulnerability is a use-after-free flaw in the AMD GPU (amdgpu) driver's device resource initialization and cleanup. The root cause is incorrect device resource cleanup ordering: the aperture memory region (aper_base_kaddr) was registered with the kernel's devm (device resource management) subsystem after the DRM device node. Since devres performs LIFO (last-in-first-out) teardown, the aperture is unmapped before the DRM device release callback fires amdgpu_device_fini_sw(), which still needs to write to the aperture through the now-invalid pointer. This occurs specifically in IP (intellectual property) subsystem software finalization callbacks like vcn_v4_0_sw_fini(), resulting in a kernel page fault. The fix reverts the problematic commit d871e99879cb and explicitly manages aperture unmapping in amdgpu_device_unmap_mmio() to ensure correct cleanup ordering. The issue is triggered on device probe failure or rollback scenarios.
Affected products
- Linux Linux kernel 5.x and later (exact ranges depend on when d871e99879cb was introduced to various stable branches)
Timeline
- 2026-09-03: disclosed
- 2026-07-30: patched: Upstream fix dated 2026-07-30; backported to stable kernels as of 2026-08-19