Vulnerability feed

Executive summary

A flaw in the Linux kernel's AMD GPU user queue code allowed a client to pin an arbitrary buffer object into the doorbell domain, which could erase that buffer's contents, including buffers shared by another client. The advisory does not state a severity rating, and the fix rejects buffers not created in the doorbell domain. Users should apply the kernel stable tree update that carries this patch.

Technical summary

The weakness is improper validation of a buffer object passed as a doorbell handle in amdgpu_userq_get_doorbell_index(), which pins any BO into the doorbell domain and causes TTM to discard its contents via ttm_bo_move_null(). An importing client on the same device can trigger this against a buffer another client shared with it, so the precondition is local access with a shared GEM object. The fix rejects BOs whose preferred_domains lack AMDGPU_GEM_DOMAIN_DOORBELL and returns -EINVAL. The advisory cites the fixing commit 7f7c88dbf4d543f6703e53bdeed380e886733167 upstream and the fixed-by commit f7497bbc19db4821c62b9d97b31c9086feb2d917 in the stable tree, and it names Fixes tag f09c1e6077ab. No affected or fixed kernel version ranges, CVSS score, workaround, or detection guidance is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/112dbe2b10d6d08…99980dd960dcbfa55ff0

Score

No CVSS score published.

Affects

LinuxAMDLinuxLinux kernelamdgpu

Executive summary

The advisory describes a fix in the Linux kernel's AMD GPU driver (drm/amdgpu) that limits how deeply ATOM command tables can nest. The advisory does not state how severe the issue is or give a CVSS score. The fix is a code change in the stable kernel tree, and no separate vendor action beyond applying that kernel update is stated.

Technical summary

The change addresses unbounded recursion in ATOM command table execution in the amdgpu driver, which the patch comment says could overflow the kernel stack. The fix caps nesting at 32 levels using an execute_depth counter in the atom_context structure and returns -ELOOP when the limit is exceeded. The advisory does not state the attack vector, required privileges, or whether the issue is exploitable by an attacker. Affected and fixed kernel version numbers are not stated beyond the commit identifier 27ef1795bc4e47cae838e0a3ced531c549f9b23d. No workarounds or detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/27ef1795bc4e47c…e0a3ced531c549f9b23d

Score

No CVSS score published.

Affects

LinuxAMDLinuxLinux kernelamdgpu

Executive summary

This advisory concerns a fix in the Linux kernel's AMD graphics driver (drm/amd/ras) that prevents a hang caused by corrupt error-record data. The advisory does not state a severity rating, and it does not state whether the hang can be triggered remotely or by a low-privileged user.

Technical summary

The flaw is a denial-of-service condition, described as a hang, in the CPER ring recovery loop of the amdgpu driver in the Linux kernel. Corrupt CPER data can produce an entry size that does not advance the read pointer after dword conversion and masking, so the loop keeps testing the same location while holding the ring mutex, which can hang the writer thread. The fix detects a no-progress read pointer update and resets the ring to an empty state, dropping the corrupt contents. The advisory does not state affected or fixed kernel version ranges, a CVSS score, workarounds, exploitation status, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/4d695e66d7027a0…2e47ac76293675fbbb4d

Score

No CVSS score published.

Affects

LinuxAMDLinuxLinux kernelamdgpu