Executive brief
The Linux kernel's AMD GPU driver (amdkfd) failed to properly clean up allocated system memory when page migration from the GPU to system RAM encountered errors. This memory leak could cause the system to exhaust available memory over time, leading to service degradation or system crashes. Systems with AMD GPUs using the amdkfd driver and IOMMU technology are most affected.
Technical details
The vulnerability exists in the svm_migrate_copy_to_ram() function in drivers/gpu/drm/amd/amdkfd/kfd_migrate.c, which handles migrating GPU memory pages to system RAM. When page migration failed, the driver incorrectly used DMA addresses (instead of physical page addresses/PFNs) to look up and release system pages, particularly problematic with IOMMU enabled. This caused allocated system pages and their DMA mappings to leak. The fix corrects the error path to properly release system pages using struct page* pointers obtained from PFNs, and to explicitly call dma_unmap_page() on all affected mappings before releasing the pages. No preconditions prevent exploitation; the leak occurs during normal error conditions when migration fails.
Affected products
- Linux Linux Kernel Multiple versions (see git commit history)
Timeline
- 2026-09-16: disclosed: CVE-2026-89810 published on NVD
- 2026-08-25: patched: Fix committed upstream (commit 960c4a8069bfd352c48cc88592618f1ebe24c69e)