CVE-2026-43318

drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify

Invalidating a dmabuf will impact other users of the shared BO.

In the scenario where process A moves the BO, it needs to inform

process B about the move and process B will need to update its

page table.

The commit fixes a synchronisation bug caused by the use of the

ticket: it made amdgpu_vm_handle_moved behave as if updating

the page table immediately was correct but in this case it's not.

An example is the following scenario, with 2 GPUs and glxgears

running on GPU0 and Xorg running on GPU1, on a system where P2P

PCI isn't supported:

glxgears:

export linear buffer from GPU0 and import using GPU1

submit frame rendering to GPU0

submit tiled->linear blit

Xorg:

copy of linear buffer

The sequence of jobs would be:

drm_sched_job_run # GPU0, frame rendering

drm_sched_job_queue # GPU0, blit

drm_sched_job_done # GPU0, frame rendering

drm_sched_job_run # GPU0, blit

move linear buffer for GPU1 access #

amdgpu_dma_buf_move_notify -> update pt # GPU0

It this point the blit job on GPU0 is still running and would

likely produce a page fault.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Published
2026-05-08T13:26Z
EPSS history
Timeline
  • 08 MAY 13:26Z
    drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
    cvelistv5