Executive brief
The AMD KFD (Kernel Fusion Driver) component of the Linux kernel contains a use-of-uninitialized-variable bug in its GPU memory migration code. When migrating GPU virtual memory with certain memory hole patterns, the driver may use an uninitialized return value and incorrectly deallocate newly-allocated GPU memory, leading to system crashes or GPU memory corruption.
Technical details
This vulnerability is a use-of-uninitialized-variable bug in the svm_migrate_copy_to_vram() function in drivers/gpu/drm/amd/amdkfd/kfd_migrate.c. The bug occurs when the VM range contains a "hole" (MIGRATE_PFN_MIGRATE set but MIGRATE_PFN_VALID unset), causing the code to allocate GPU pages but skip DMA mapping. If the loop counter j becomes 0, the code calls svm_migrate_copy_memory_gart() with an uninitialized return value r, which may then trigger incorrect cleanup code that deallocates valid GPU memory. The patch initializes r to 0 and adds a guard condition (j > 0) before the final copy operation, ensuring the function only uses properly-initialized values and handles memory correctly.
Affected products
- Linux Linux kernel affected versions vary by distribution; patch released 2026-08-25
Timeline
- 2026-09-16: disclosed: CVE published on NVD
- 2026-08-25: patched: Fix committed by Alex Deucher (520e345ffe05aabef1db82beda4288afb1757ff2)