CVE-2026-45853: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

CVE-2026-45853: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

amdgpu_discovery_get_nps_info() internally allocates memory for ranges
using kvcalloc(), which may use vmalloc() for large allocation. Using
kfree() to release vmalloc memory will lead to a memory corruption.

Use kvfree() to safely handle both kmalloc and vmalloc allocations.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

The Linux kernel CVE team has assigned CVE-2026-45853 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 6.12.75 with commit 16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e
	Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 6.18.14 with commit 9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5
	Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 6.19.4 with commit f441538893eba6347b983f2904819ca6c99da65e
	Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 7.0 with commit 0c44d61945c4a80775292d96460aa2f22e62f86c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-45853
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e
	https://git.kernel.org/stable/c/9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5
	https://git.kernel.org/stable/c/f441538893eba6347b983f2904819ca6c99da65e
	https://git.kernel.org/stable/c/0c44d61945c4a80775292d96460aa2f22e62f86c