Executive brief
AMD GPUs with multiple XCC (eXecution Cores) may experience kernel crashes during initialization when the device driver fails to allocate memory for all XCC units. A loop that initializes queue database arrays iterates too few times, leaving some structures uninitialized and causing null pointer dereference crashes when the GPU attempts to use those uninitialized entries.
Technical details
The vulnerability is an insufficient loop iteration in the amdgpu MES (Micro Engine Scheduler) initialization code. The hung_queue_db_array loop was constrained to AMDGPU_MAX_MES_PIPES iterations, but on multi-XCC GPUs it must iterate AMDGPU_MAX_MES_PIPES * num_xcc times to initialize arrays for all XCC IDs. When an array is indexed with XCC ID >= 2, uninitialized entries cause null pointer dereferences. The fix extends the loop bound to cover all XCC units, aligning with initialization of other per-XCC arrays. This is a kernel-space memory safety issue triggered during device initialization on affected AMD GPUs; no user interaction or network access required.
Affected products
- Linux Linux kernel Affected versions prior to commit 2c256086a363f01f9840a57949506eccf5c990a6
Timeline
- 2026-09-17: disclosed: CVE-2026-93139 published
- 2026-06-28: patched: Upstream fix committed by Geoffrey McRae
- 2026-09-14: patched: Patch backported to stable kernel branches via commit 7ff668cfc3960ed5b944ac35129f18a15ea08b74