Executive brief
AMD GPUs use a Media Engine Scheduler (MES) to manage work submissions. When a GPU reset occurs, the MES ring's fence tracking becomes misaligned, causing subsequent work submissions to hang indefinitely. This can wedge the system and force a second reset, resulting in system instability and service disruption.
Technical details
The vulnerability is a logic flaw in the Linux kernel's AMD GPU driver (drm/amdgpu). The MES scheduler ring lacks a DRM scheduler and is not covered by the force-completion loop in amdgpu_device_pre_asic_reset(). During a reset triggered by MES unresponsiveness, the fence_drv.sync_seq counter advances beyond the last hardware fence value written to GTT memory. After resume, the first MES submission polls on a stale sequence number that never gets written, causing an infinite hang. The fix adds explicit fence completion for MES scheduler rings to realign the hardware fence with sync_seq. No authentication or network access is required; the issue occurs during GPU reset operations in the kernel.
Affected products
- Linux Linux kernel Multiple stable versions (linux-5.x through linux-7.x)
Timeline
- 2026-09-16: disclosed
- 2026-08-19: patched: Upstream commit 48dc279c3010ac8f91b1845b2abb3a1e9943a0f5
- 2026-09-11: patched: Backported to stable kernels via commit ebe7542553d008e2285e0fbba0c63f0295a7e694