From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6F334ACC8B for ; Thu, 24 Sep 2026 16:07:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790266044; cv=none; b=YusVaFMiiR8svVYHeR6nD3LKG0IaTdNP4GQijHTdpha3NwttG9v38j5btllZ0Ve/Q4zHC8QOh+778qv/VehZFGMek+RlPtCXkA6h0ShMRuCcHfE4Qx0kiparXg0D9qnKTgNrx3SAPk7bTxVXpgcA98yM2/3iPpe5VCjUlt6zJuw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790266044; c=relaxed/simple; bh=0P4Eu3ld5Hb2v5PeMIXXvdLXvS7INnnudsxCazQd4vA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RB7HGVwYKSX0rHencm+5CqGFFQhuqfIfp/82WAWVmJjzXLANe7dUlFF/yBMzP//x4KG72Ps0NoMf/g6nYp2mxjgXTYz8FRl0aaklWTHNz9gwB6q6q+S0LTTA1+P/ctYow6BPelbzZ8Qp1fVlFGWUAhPyjIH+z3rsCBIodLC2oQs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=J1awnV04; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="J1awnV04" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2A521F00893; Thu, 24 Sep 2026 16:07:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790266042; bh=wdCGKkeYcLhIEE7CqcrCJhqmTJTvnJ8/ufPBIOQrXLg=; h=From:To:Cc:Subject:Date:Reply-To; b=J1awnV04hpHmh+9tdHhiQ5gXzHfRI3m/J1QHOTxHGfFVg/KkrRqUuMPwIBO1s8SUh 8m7Xe5D3nYcBaeKvbYtz2pG1D89UVIAaTlC6BJ/hPAzBD+F+6bxZAlYMHjKeb9dGlt /0WXuqdprPKiBowbOd9Yw71GFjXxoAAJUga7jT6s= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-93809: drm/amdgpu: flush pending RCU callbacks on module unload Date: Thu, 24 Sep 2026 18:02:45 +0200 Message-ID: <2026092420-CVE-2026-93809-963e@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3481; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=QJx2X4K1z0O3b0qnnS05K18kIFpdmjUKSpR3NxnLrQc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlbPXs8ltlemGd8/v4vV521y23TGN2zvn247eUtfzqH1 f661LJFHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCROEOGBev8r67r/PDw4bvu z1L7+n95f/nXX86woHNvl/AlQ4ay6FcT7yR9PXsrP877NwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcu_barrier() in module exit to wait for outstanding call_rcu() callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to handle page fault for address: ffffffffc1d59c40 PGD 6a12067 P4D 6a12067 PUD 6a14067 PMD 13698b067 PTE 0 Oops: 0010 [#1] SMP NOPTI RIP: 0010:0xffffffffc1d59c40 Code: Unable to access opcode bytes at RIP 0xffffffffc1d59c16. RSP: 0018:ffffc900198c0f28 EFLAGS: 00010286 RAX: ffffffffc1d59c40 RBX: ffff897c7d6b61c0 RCX: ffff88826aff4590 RDX: ffff8884d8b35490 RSI: ffffc900198c0f30 RDI: ffff88812af67290 RBP: 000000000000000a (DONE segment entries) R08: 0000000000000000 R09: 0000000000000100 R10: 0000000000000000 R11: ffffffff82a06100 R12: ffff88811a4e3700 R13: 0000000000000000 R14: ffff897c7d6b6270 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff897c7d680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc1d59c16 CR3: 00000104a980a001 CR4: 0000000002770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? rcu_do_batch+0x163/0x450 ? rcu_core+0x177/0x1c0 ? __do_softirq+0xc1/0x280 ? asm_call_irq_on_stack+0xf/0x20 ? do_softirq_own_stack+0x37/0x50 ? irq_exit_rcu+0xc4/0x100 ? sysvec_apic_timer_interrupt+0x36/0x80 ? asm_sysvec_apic_timer_interrupt+0x12/0x20 ? cpuidle_enter_state+0xd4/0x360 ? cpuidle_enter+0x29/0x40 ? cpuidle_idle_call+0x108/0x1a0 ? do_idle+0x77/0xf0 ? cpu_startup_entry+0x19/0x20 ? secondary_startup_64_no_verify+0xbf/0xcb (cherry picked from commit feaa5039f6c12acc9aa934c2d45dcd251a12c69f) The Linux kernel CVE team has assigned CVE-2026-93809 to this issue. Affected and fixed versions =========================== Fixed in 6.12.111 with commit 5063ae84c45299a100bf1d6ed11945f688063649 Fixed in 6.18.53 with commit 27d43ad57759c73b8fad5b2bad62a0616e116bbc Fixed in 7.2 with commit 67a654b41cfa73c3b83402c4a01b2689cad5b9bc Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-93809 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5063ae84c45299a100bf1d6ed11945f688063649 https://git.kernel.org/stable/c/27d43ad57759c73b8fad5b2bad62a0616e116bbc https://git.kernel.org/stable/c/67a654b41cfa73c3b83402c4a01b2689cad5b9bc