CVE-2026-90286

CVE-2026-90286

High · published September 17, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/gfx6: Use PFP on the compute queues too

On GFX6, the compute rings use the same CP path as

the graphics ring. The only difference is that they

don't support draw commands. (As opposed to GFX7 and

newer which have a separate command parser that is

called MEC for compute queues.)

This means that we have to take into consideration

that the PFP also exists on compute queues on GFX6:

Use PFP for register writes on both graphics and

compute queues.

In the pipeline sync, use the PFP to wait for the

previous fence (and not the ME) to prevent the PFP

from starting to execute the next submission while

the ME is still in the previous submission.

After a VM flush, emit PFP_SYNC_ME on compute

queues as well.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Published
2026-09-17T21:17Z
References (8)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:08Z
    drm/amdgpu/gfx6: Use PFP on the compute queues too
    cvelistv5