{"id":"CVE-2026-98520","title":"drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n\nkfd_dev_mapping caches the address_space of the first /dev/kfd opener\nso that the GPU reset p…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 70cadefcc6160c575b04f763ada34c20e868d577 < 02b74891624e09a5512c6d84f267d01fcc306a3b","Linux >= 70cadefcc6160c575b04f763ada34c20e868d577 < c3a31087b1c8df679b653c1a09d9abe5ff7ec8ef","Linux 7.2"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:17:38.113Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98520","references":[{"url":"https://git.kernel.org/stable/c/02b74891624e09a5512c6d84f267d01fcc306a3b"},{"url":"https://git.kernel.org/stable/c/c3a31087b1c8df679b653c1a09d9abe5ff7ec8ef"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.283Z","slug":"CVE-2026-98520","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n\nkfd_dev_mapping caches the address_space of the first /dev/kfd opener\nso that the GPU reset path can call unmap_mapping_range() to zap all\nuserspace mappings of doorbell and MMIO ranges.  This design has two\nbugs that both manifest under SRIOV with multiple containers:\n\n1. Use-after-free / rwsem deadlock.  The cached pointer refers to an\n   inode owned by the first opener's container.  When that container\n   exits and its inode is released, kfd_dev_mapping becomes a dangling\n   pointer.  A subsequent GPU reset dereferences it inside\n   unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,\n   causing a hard hang observable as an uninterruptible rwsem wait.\n\n2. Multi-container gap.  Only the first opener's address_space is cached;\n   VMAs created by later openers live in a different address_space and\n   are never reached by unmap_mapping_range().  After a GPU reset those\n   stale mappings keep doorbell and MMIO pages accessible to guest\n   userspace with no GPU behind them, risking PCIe transaction timeouts\n   and NMI panics.\n\nFix both bugs with the same approach used by DRM core (drm_drv.c):\ncreate a private pseudo-filesystem at module init time and allocate one\nanonymous inode from it.  In kfd_open() redirect every opener's\nfile->f_mapping to that inode's address_space.  The inode is\nmodule-owned, lives exactly as long as the amdgpu module, and collects\nVMAs from all openers in one address_space.  A single\nunmap_mapping_range() call in the reset path then correctly reaches\nevery container's mappings with no dangling pointer risk.\n\nThe hang manifests as an NMI backtrace on the GPU reset workqueue stuck\nspinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem:\n\n  Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu]\n  Call Trace:\n   <TASK>\n   kvm_wait+0x1f/0x40\n   __pv_queued_spin_lock_slowpath+0x31d/0x3a0\n   _raw_spin_lock_irq+0x51/0x80\n   rwsem_down_read_slowpath+0xb3/0x550\n   down_read+0x48/0xd0\n   unmap_mapping_range+0x71/0x140\n   kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu]\n   amdgpu_amdkfd_clear_kfd_mapping+0xd8/0x190 [amdgpu]\n   amdgpu_device_gpu_recover+0x232/0x450 [amdgpu]\n   xgpu_ai_mailbox_flr_work+0xb5/0xc0 [amdgpu]\n   process_one_work+0x18e/0x3e0\n   worker_thread+0x2e3/0x420\n   kthread+0x10a/0x230\n\n(cherry picked from commit 1128b4a52de1572e87431de837fd9850cb99542c)\n\n## Affected\n\n- `Linux >= 70cadefcc6160c575b04f763ada34c20e868d577 < 02b74891624e09a5512c6d84f267d01fcc306a3b`\n- `Linux >= 70cadefcc6160c575b04f763ada34c20e868d577 < c3a31087b1c8df679b653c1a09d9abe5ff7ec8ef`\n- `Linux 7.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}