amdkfd: uninitialized return on a hole in the migrated range drops VRAM pages just allocated

Impact

svm_migrate_copy_to_vram() still allocated device pages when the CPU-side range was a hole (MIGRATE_PFN_MIGRATE set without MIGRATE_PFN_VALID). With nothing to map or copy, the copy helper returned an uninitialized value, which could send the function down out_free_vram_pages and free all of the VRAM it had just set up. For a ROCm node this is in the heart of the HSA shared-virtual-memory migration path used by every unified-memory kernel: a tenant whose address range happens to contain a hole can get device memory released out from under a live mapping, with the state of the queue's VRAM allocation decided by stack garbage. Expect memory corruption or GPU faults rather than a clean error, and a node whose GPU has to be reset to recover.

Who can reach it

Local. Any process holding /dev/kfd on an AMD GPU - i.e. any tenant with a ROCm container - that prefetches or migrates an SVM range containing an unmapped hole. No elevated privileges needed.

What to do

Apply the stable-kernel update that initializes r and only issues the final svm_migrate_copy_memory_gart() when j > 0. amdkfd is built into the kernel tree, so the fix ships with the kernel: drain the GPU jobs and reboot the node. If your fleet runs the packaged AMD DKMS stack instead, take the vendor kernel module build that carries the same commit and reload the driver with no GPU workloads attached.

References

Related entries

• amdkfd: device-to-RAM migration error path releases pages by DMA address, corrupting unrelated pagesCVE-2026-89810 · Linux kernel amdkfd (svm_migrate_copy_to_ram error path, DMA address used as PFN)High
• amdgpu: rings outside a partition index the isolation array out of bounds on SDMA submitCVE-2026-89814 · Linux kernel amdgpu (adev->isolation[] indexed with AMDGPU_XCP_NO_PARTITION)High
• drm/ttm: stale restore state after a successful restore leaves shmem handles in the page arrayCVE-2026-89815 · Linux kernel drm/ttm (ttm_pool_restore_and_alloc, stale tt->restore)High
• Linux kernel drm/xe: flat CCS storage published as usable VRAM, corrupting allocationsCVE-2026-90047 · Linux kernel drm/xe (flat CCS offset rounding)High
• NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): An out-of-bounds readCVE-2022-28183 · NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko)High
• DGX servers BMC: Improper access control on BMCCVE-2022-42275 · DGX servers BMCHigh