Linux kernel amdgpu: use of freed module text when RCU callbacks run after module unload

Impact

amdgpu did not call rcu_barrier() in its module exit path, so a pending call_rcu() callback could fire after the module text was freed, jumping into unmapped memory and panicking the kernel - the reported trace is a page fault in rcu_do_batch from softirq context. This only bites on amdgpu module unload, which on a GPU node means driver reinstall or upgrade, a ROCm stack update, or an automated driver rollout; the failure mode is a host crash that takes every workload on the node with it and needs a reboot. It is not a tenant-reachable attack path: unloading the module requires root on the host. Treat it as a stability fix to fold into the next driver-upgrade window rather than an urgent security patch.

Who can reach it

Local root on the host, since only a privileged user can unload the amdgpu module. Not reachable by tenants holding /dev/kfd or /dev/dri, and not reachable over the network.

What to do

Pick up the stable kernel containing commit 67a654b41cfa (upstream feaa5039f6c1) from your distribution's kernel updates. Applying it means installing a new kernel and rebooting the node, so drain the GPU node and fold it into a scheduled reboot window - there is no runtime mitigation short of not unloading amdgpu, which is itself a reasonable interim rule: reboot rather than rmmod when updating the driver.

References

Related entries

• Linux kernel amdkfd: user-controlled metadata size lets any render-group user force a huge kernel allocationCVE-2026-93823 · Linux kernel amdkfd (AMDKFD_IOC_GET_DMABUF_INFO metadata buffer)Unscored
• Linux kernel amdgpu: unclamped write position in the vBIOS update sysfs attribute overflows the bufferCVE-2026-97425 · Linux kernel amdgpu (vBIOS update sysfs bin attribute)Unscored
• Linux kernel amdgpu powerplay: pp_table sysfs write memcpys up to PAGE_SIZE into a smaller heap bufferCVE-2026-97427 · Linux kernel amdgpu powerplay (pp_dpm_set_pp_table sysfs store)Unscored
• Linux kernel drm/amdgpu: unbounded VBIOS GPIO I2C entry count overruns adev->i2c_bus[]CVE-2026-97493 · Linux kernel amdgpu VBIOS GPIO I2C table parsing (drm/amdgpu)Unscored
• Linux amdgpu: PSP firmware image copied into the 1 MiB private buffer without a size checkCVE-2026-97494 · Linux kernel drm/amdgpu (PSP firmware private buffer, psp_copy_fw)Unscored
• Linux amdkfd: caller-supplied doorbell id is not bounds checked in allocate_doorbellCVE-2026-97495 · Linux kernel drm/amdkfd (allocate_doorbell, caller-supplied doorbell id)Unscored