CVE-2026-80728

In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/amdgpu: fix aperture mapping leak"

devres teardown is LIFO. The aperture devres node was registered after

the DRM device node, so devres_release_all() unmaps the aperture before

the DRM device release callback fires amdgpu_device_fini_sw(). IP

sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a

pointer derived from aper_base_kaddr, causing a kernel page fault on

probe failure / rollback:

BUG: unable to handle page fault ... PMD 0

RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu]

Call Trace:

amdgpu_device_fini_sw

amdgpu_driver_release_kms

devm_drm_dev_init_release

devres_release_all

This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a.

(cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)