Skip to content
OpenAdvisories
Unscored CVE-2026-31765 EUVD-2026-26578GHSA-gj7p-3xqj-68g4

drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB

Published May 1, 2026 · Updated Nov 6, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.2 Package: linux-azure-nvidia-6.14 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB

Currently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while
KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with
4K pages, both values match (8KB), so allocation and reserved space
are consistent.

However, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,
while the reserved trap area remains 8KB. This mismatch causes the
kernel to crash when running rocminfo or rccl unit tests.

Kernel attempted to read user page (2) - exploit attempt? (uid: 1001)
BUG: Kernel NULL pointer dereference on read at 0x00000002
Faulting instruction address: 0xc0000000002c8a64
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
CPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E
6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY
Tainted: [E]=UNSIGNED_MODULE
Hardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006
of:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries
NIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730
REGS: c0000001e0957580 TRAP: 0300 Tainted: G E
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268
XER: 00000036
CFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000
IRQMASK: 1
GPR00: c00000000125d908 c0000001e0957820 c0000000016e8100
c00000013d814540
GPR04: 0000000000000002 c00000013d814550 0000000000000045
0000000000000000
GPR08: c00000013444d000 c00000013d814538 c00000013d814538
0000000084002268
GPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff
0000000000020000
GPR16: 0000000000000000 0000000000000002 c00000015f653000
0000000000000000
GPR20: c000000138662400 c00000013d814540 0000000000000000
c00000013d814500
GPR24: 0000000000000000 0000000000000002 c0000001e0957888
c0000001e0957878
GPR28: c00000013d814548 0000000000000000 c00000013d814540
c0000001e0957888
NIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0
LR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00
Call Trace:
0xc0000001e0957890 (unreliable)
__mutex_lock.constprop.0+0x58/0xd00
amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]
kfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]
kfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]
kfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]
kfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]
kfd_ioctl+0x514/0x670 [amdgpu]
sys_ioctl+0x134/0x180
system_call_exception+0x114/0x300
system_call_vectored_common+0x15c/0x2ec

This patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and
KFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve
64 KB for the trap in the address space, but only allocate 8 KB within
it. With this approach, the allocation size never exceeds the reserved
area.

(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)

Affected products

VendorProductAffectedFixed
Linux Linux 6.9 6.12.81

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.19.12-1 —
Debian 13 linux 6.12.85-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1006.6 —
Ubuntu 25.10 linux +8 No fix yet —
Ubuntu 24.04 LTS linux-riscv +26 No fix yet —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +4 6.4.0-150700.53.73.2 SUSE-SU-2026:3166-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.73.2.150700.17.41.4 SUSE-SU-2026:3166-1
SLES 15 SP7 kernel-docs +2 6.4.0-150700.53.73.1 SUSE-SU-2026:3166-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.37.1 SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.37.1 SUSE-SU-2026:23237-1, SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES 16.0 kernel-default-base 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23068-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.37.1 SUSE-SU-2026:23068-1, SUSE-SU-2026:23066-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.73.2 SUSE-SU-2026:3166-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_18 1-150700.1.5.1 SUSE-SU-2026:3130-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_19 1-150700.15.3.4 SUSE-SU-2026:3166-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.67.1 SUSE-SU-2026:3130-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.37.1.160000.2.19 openSUSE-SU-2026:21555-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.37.1 openSUSE-SU-2026:21555-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-204.92.4.2.el10uek ELSA-2026-50372

Advisories 9

References