---
id: CVE-2026-89814
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: clamp the isolation index for rings outside a partition

  adev->isolation[] has one slot per partition, but a ring that is not
  assigned to one keeps AMDGPU_X…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: clamp the isolation index for rings outside a partition

  adev->isolation[] has one slot per partition, but a ring that is not
  assigned to one keeps AMDGPU_X…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    964de255497ffd7cb8a86e405b8ac6d927e7e177
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    0bfb938182d1313e5cac32ae38dbaaa4eabe4af4
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b30900566642ceb2c9e12b56c2afec28d0fd91a0
  - Linux < 6.18.51
  - Linux < 7.2.5
  - Linux (all versions)
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T10:17:04.577'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89814'
references:
  - url: 'https://git.kernel.org/stable/c/0bfb938182d1313e5cac32ae38dbaaa4eabe4af4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/964de255497ffd7cb8a86e405b8ac6d927e7e177'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b30900566642ceb2c9e12b56c2afec28d0fd91a0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:54.005Z'
epss: 0.00173
epssPercentile: 0.05962
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: clamp the isolation index for rings outside a partition

adev->isolation[] has one slot per partition, but a ring that is not
assigned to one keeps AMDGPU_XCP_NO_PARTITION, which is ~0, so indexing
the array with it is out of bounds. SDMA submissions hit this on both
the isolation enforcement and the VM flush path and trip UBSAN.

Fall back to the first slot the way the cleaner shader path already
does, and stop taking the address before the ring type check that makes
it relevant.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.