Description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
MES (Micro Engine Scheduler) does not perform heavy-weight TLB
invalidation after unmapping queues, unlike HWS which does this
automatically. This causes a race condition where in-flight DMA
descriptors can access memory that has been unmapped, leading to page
faults and GPU queue hangs during SVM page migration.
The issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest
failures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU
compute queue hangs with packets submitted but never consumed.
Add kfd_flush_tlb() calls after MES queue removal in two locations:
- evict_process_queues_cpsch(): after all queues removed during eviction
- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)
This ensures all in-flight memory accesses from unmapped queues are
flushed before memory is freed or migrated.
(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.19 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.2.6-1 | — |
| Debian 13 | linux | 6.12.115-2 | — |
| Debian 12 | linux | No fix yet | — |
| Debian 12 | linux-6.12 | 6.12.115-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-42.42 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1016.17 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1020.21 | USN-9019-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1019.19 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-gcp | 7.0.0-1016.18 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1010.11 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1017.17 | USN-8960-1, USN-8959-1 |
| Ubuntu 26.04 LTS | linux-nvidia +1 | No fix yet | — |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1015.16 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-realtime | 7.0.0-43.43.1 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-riscv | 7.0.0-42.42.1 | — |
| Ubuntu 24.04 LTS | linux +45 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1017.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1019.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 | 7.0.0-1017.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-42.42~24.04.1 | USN-8959-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1038.42 | USN-9002-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1016.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-42.42.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +42 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +3 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +77 | 6.12.0-211.68.1.el10_2 | RHSA-2026:98608, RHSA-2026:88477 |
| RHEL 9 | rv +75 | 5.14.0-687.57.1.el9_8 | RHSA-2026:97873, RHSA-2026:81552 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.173.1.rt7.514.el8_10 | RHSA-2026:82806 |
| RHEL 8 | perf +26 | 4.18.0-553.173.1.el8_10 | RHSA-2026:82807 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Shadow Migration Toolkit 10 | kernel-modules-internal | 6.12.0-211.68.1.el10_2 | RHSA-2026:88477 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.68.1.el10_2 | ALSA-2026:88477 |
| AlmaLinux 9 | kernel +17 | 5.14.0-687.57.1.el9_8 | ALSA-2026:81552 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.173.1.rt7.514.el8_10 | ALSA-2026:82806 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.173.1.el8_10 | ALSA-2026:82807 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-211.68.1.el10_2 | RLSA-2026:88477 |
| Rocky Linux 9 | kernel | 5.14.0-687.57.1.el9_8 | RLSA-2026:97873, RLSA-2026:81552 |
| Rocky Linux 9 | rv +74 | 5.14.0-741.20.1.el9_9 | RLSA-2026:97873 |
| Rocky Linux 8 | kernel | 4.18.0-553.173.1.el8_10 | RLSA-2026:82807 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.173.1.rt7.514.el8_10 | RLSA-2026:82806 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +5 | 6.4.0-150700.53.87.3 | SUSE-SU-2026:4935-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.87.3.150700.17.49.2 | SUSE-SU-2026:4935-1 |
| SLES 15 SP7 | kernel-obs-build | 6.4.0-150700.53.87.2 | SUSE-SU-2026:4935-1 |
| SLES 15 SP7 | kernel-syms | 6.4.0-150700.53.87.1 | SUSE-SU-2026:4935-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.40.1 | SUSE-SU-2026:24446-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | SUSE-SU-2026:24446-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.40.1 | SUSE-SU-2026:24446-1, SUSE-SU-2026:24437-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | SUSE-SU-2026:24446-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | SUSE-SU-2026:24422-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.40.1 | SUSE-SU-2026:24422-1, SUSE-SU-2026:24386-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-159998.54.1.159998.21.39 | SUSE-SU-2026:24379-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-159998.54.1 | SUSE-SU-2026:24553-1, SUSE-SU-2026:24379-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-159998.54.1.159998.21.40 | SUSE-SU-2026:24371-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-159998.54.1 | SUSE-SU-2026:24473-1, SUSE-SU-2026:24371-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.87.3 | SUSE-SU-2026:4935-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_22 | 1-150700.1.3.1 | SUSE-SU-2026:4940-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_23 | 1-150700.15.3.2 | SUSE-SU-2026:4935-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.81.1 | SUSE-SU-2026:4940-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.2.7-1.1 | openSUSE-SU-2026:11880-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | openSUSE-SU-2026:22167-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.40.1 | openSUSE-SU-2026:22167-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.161.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-211.68.1.el10_2 | ELSA-2026-88477 |
| Oracle Linux 9 | rv +28 | 5.14.0-687.57.1.el9_8 | ELSA-2026-81552 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.173.1.el8_10 | ELSA-2026-82807 |
Advisories 37
- USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8959-1 linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9019-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8960-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9002-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- RHSA-2026:98608 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:97873 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88477 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:81552 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:82806 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:97873 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3438 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- SUSE-SU-2026:24553-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 7, 2026
- SUSE-SU-2026:24473-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 4, 2026
- SUSE-SU-2026:24446-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 1, 2026
- SUSE-SU-2026:24437-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 1, 2026
- SUSE-SU-2026:4940-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 31, 2026
- SUSE-SU-2026:4935-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 31, 2026
- SUSE-SU-2026:24422-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 30, 2026
- SUSE-SU-2026:24386-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 30, 2026
- ALSA-2026:81552 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:88477 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:82807 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:82806 Important: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:24379-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24371-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 27, 2026
- openSUSE-SU-2026:22167-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 25, 2026
- RLSA-2026:88477 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 24, 2026
- ELSA-2026-88477 Important: kernel security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 23, 2026
- RHSA-2026:82807 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:82806 Important: kernel-rt security update Rocky Linux Security Advisories · Oct 15, 2026
- RLSA-2026:82807 Important: kernel security update Rocky Linux Security Advisories · Oct 15, 2026
- RLSA-2026:81552 Important: kernel security update Rocky Linux Security Advisories · Oct 14, 2026
- ELSA-2026-82807 Important: kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 14, 2026
- ELSA-2026-81552 Important: kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 13, 2026
- openSUSE-SU-2026:11880-1 kernel-devel-7.2.7-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
References
- https://git.kernel.org/stable/c/750cd793ee69c27faf17fb9c49f92f71716bbc8b
- https://git.kernel.org/stable/c/5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1
- https://git.kernel.org/stable/c/bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372
- https://git.kernel.org/stable/c/e230c546ed93741833ab5babb0b202f9c2052b45
- https://git.kernel.org/stable/c/6aae545c87087e4dc96e205452243813bfa73ba2
- https://git.kernel.org/stable/c/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4