Executive brief
The AMD GPU compute queue scheduler (amdkfd) in the Linux kernel has a race condition where GPU memory accesses can occur after memory has been unmapped during process eviction or suspension. This causes GPU queue hangs and page faults during GPU memory migration operations, disrupting GPU compute workloads and potentially causing denial of service to applications relying on GPU acceleration.
Technical details
The vulnerability exists in the MES (Micro Engine Scheduler) queue management in drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c. Unlike HWS (hardware scheduler), MES does not perform TLB (Translation Lookaside Buffer) invalidation after unmapping queues, creating a race where in-flight DMA descriptors can access memory that has been freed or migrated. This manifests as GPU queue hangs during SVM (Shared Virtual Memory) page migration on gfx1151 (Strix Point) with XNACK mode enabled. The fix adds kfd_flush_tlb() calls in evict_process_queues_cpsch() and suspend_queues() functions to ensure all in-flight memory accesses complete before memory is freed or migrated. No authentication or user interaction is required—the vulnerability triggers automatically during normal GPU memory management operations.
Affected products
- Linux Linux kernel various; fixed in stable releases after commit 94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-02: patched: Upstream fix commit 94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4
- 2026-09-11: patched: Stable kernel backport commit 6aae545c87087e4dc96e205452243813bfa73ba2