Executive brief
The Linux kernel's AMD GPU (amdgpu) driver has a flaw in how it handles the KIQ (Kernel Interface Queue) ring during hardware resets. After a reset, GPU submissions can hang indefinitely waiting for a fence condition that will never be satisfied, causing the GPU to become unresponsive and requiring a system restart to recover.
Technical details
The vulnerability is a logic error in amdgpu_device_pre_asic_reset() in drivers/gpu/drm/amd/amdgpu/amdgpu_device.c. The KIQ ring uses polling-based fences and sets no_scheduler=true, causing it to be excluded from the force-completion loop that realigns fence state during hardware resets. After a MODE1 reset, the KIQ ring's hardware fence value (stored in GTT memory) survives the reset while fence_drv.sync_seq continues to advance, creating a desynchronization. Subsequent KIQ submissions poll forever on a stale sequence number that is never updated. The fix adds explicit fence force-completion for all KIQ rings during pre-reset, realigning the hardware fence value with sync_seq. This is a local denial-of-service condition affecting any system using AMD GPUs that undergo hardware resets.
Affected products
- Linux Linux kernel affected versions include at least Linux 5.x and 6.x; patch added to stable branches
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-08-19: patched: Upstream patch by Alex Deucher
- 2026-09-11: other: Backported to stable branches by Greg Kroah-Hartman