Executive brief
The Linux kernel's AMD GPU driver contains a flaw in how it handles uninitialized GPU video decode rings when running in virtualized SR-IOV mode. When the system resumes, it unconditionally attempts to complete fence operations on rings that were never initialized, potentially causing system instability or hangs on affected virtualized GPU instances.
Technical details
The vulnerability is a logic error in the amdgpu UVD (Unified Video Decoder) resume path. The function amdgpu_uvd_resume() unconditionally calls amdgpu_fence_driver_force_completion() on decode rings without verifying that the fence driver was initialized. In SR-IOV VF (virtual function) configurations, uvd_v7_0_sw_init() skips initialization of the UVD decode ring, leaving the fence driver uninitialized. When amdgpu_uvd_resume() is later called during system resume, it attempts to force-complete the fence on the uninitialized ring, leading to potential crashes or undefined behavior. The fix adds a simple check to skip fence completion if the fence driver is not initialized. No special privileges or network access are required; the condition occurs during normal system resume operations on vulnerable SR-IOV VF instances.
Affected products
- Linux Linux kernel Linux 4.x through 7.x (all versions prior to the fix)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-08-25: patched: Upstream fix committed by Alex Deucher
- 2026-09-11: patched: Backported to stable kernels via Greg Kroah-Hartman