CVE-2026-89978

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where the SYNC BO operation does not constrain its size, allowing a request for zero bytes to reach the drm clflush virt range() function. This function performs an unconditional clflushopt(end - 1) operation; when the range is empty, this access targets the byte immediately preceding the mapping. Since abo->mem.kva is derived from vmap(), the access hits a guard page below the vmalloc area, resulting in a kernel page fault. Any process capable of opening the render node can trigger this by calling SYNC BO with a size of 0 on an AMDXDNA BO SHARE object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.