Executive brief
The AMD GPU driver in the Linux kernel had a synchronization issue in GFX6 graphics processors where compute queues were not properly coordinating command execution between different processing units (PFP and ME). This could allow compute tasks to start executing before previous tasks completed, potentially causing GPU memory corruption, data loss, or system instability on systems using GFX6 AMD GPUs.
Technical details
The vulnerability exists in the DRM amdgpu driver's GFX6 graphics pipeline implementation (drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c). On GFX6 hardware, compute rings share the same command processor (CP) path as graphics rings, but the driver was only using the Prefetch Unit (PFP) for synchronization on graphics queues, not compute queues. This caused race conditions in three areas: pipeline synchronization (not waiting for PFP before next submission), VM flush operations (not emitting PFP_SYNC_ME on compute queues), and register writes (not using PFP on compute queues). An attacker with ability to submit compute workloads could exploit this to cause out-of-order command execution, leading to memory corruption or denial of service. The fix was to enable PFP synchronization unconditionally on all queue types.
Affected products
- Linux Linux kernel GFX6 variants (prior to fix commit 60f20946cd318518ddc2c0da12103c666b2b9564)
Timeline
- 2026-09-17: disclosed
- 2026-08-06: patched: Fix commit 60f20946cd318518ddc2c0da12103c666b2b9564 authored 2026-08-03, committed by Alex Deucher