PT-2026-116739 · Linux · Linux
CVE-2026-98520
·
Publicado
2026-10-18
·
Atualizado
2026-10-18
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix use-after-free and multi-container gap in kfd dev mapping
kfd dev mapping caches the address space of the first /dev/kfd opener
so that the GPU reset path can call unmap mapping range() to zap all
userspace mappings of doorbell and MMIO ranges. This design has two
bugs that both manifest under SRIOV with multiple containers:
-
Use-after-free / rwsem deadlock. The cached pointer refers to an inode owned by the first opener's container. When that container exits and its inode is released, kfd dev mapping becomes a dangling pointer. A subsequent GPU reset dereferences it inside unmap mapping range(), which takes i mmap rwsem on the freed inode, causing a hard hang observable as an uninterruptible rwsem wait.
-
Multi-container gap. Only the first opener's address space is cached; VMAs created by later openers live in a different address space and are never reached by unmap mapping range(). After a GPU reset those stale mappings keep doorbell and MMIO pages accessible to guest userspace with no GPU behind them, risking PCIe transaction timeouts and NMI panics.
Fix both bugs with the same approach used by DRM core (drm drv.c):
create a private pseudo-filesystem at module init time and allocate one
anonymous inode from it. In kfd open() redirect every opener's
file->f mapping to that inode's address space. The inode is
module-owned, lives exactly as long as the amdgpu module, and collects
VMAs from all openers in one address space. A single
unmap mapping range() call in the reset path then correctly reaches
every container's mappings with no dangling pointer risk.
The hang manifests as an NMI backtrace on the GPU reset workqueue stuck
spinning in rwsem down read slowpath() with a corrupted i mmap rwsem:
Workqueue: amdgpu-reset-dev xgpu ai mailbox flr work [amdgpu]
Call Trace:
kvm wait+0x1f/0x40
pv queued spin lock slowpath+0x31d/0x3a0
raw spin lock irq+0x51/0x80
rwsem down read slowpath+0xb3/0x550
down read+0x48/0xd0
unmap mapping range+0x71/0x140
kfd dev unmap mapping range+0x5b/0x140 [amdgpu]
amdgpu amdkfd clear kfd mapping+0xd8/0x190 [amdgpu]
amdgpu device gpu recover+0x232/0x450 [amdgpu]
xgpu ai mailbox flr work+0xb5/0xc0 [amdgpu]
process one work+0x18e/0x3e0
worker thread+0x2e3/0x420
kthread+0x10a/0x230
(cherry picked from commit 1128b4a52de1572e87431de837fd9850cb99542c)
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux