CVE-2026-80618

A flaw was found in the kernel's AMD GPU driver (drm/amdkfd). This vulnerability occurs when the driver attempts to unpin a memory buffer object (BO) twice during memory deallocation. A local attacker could exploit this double-unpin operation, leading to a memory management error. This issue can cause system instability or a denial of service (DoS).

A moderate-impact flaw was found in the Linux kernel's AMD GPU compute driver (drm/amdkfd) as shipped in Red Hat Enterprise Linux 8, 9, and 10, and in Red Hat In-Vehicle OS 2. In amdgpu_amdkfd_gpuvm_free_memory_of_gpu(), DOORBELL and MMIO remap buffer objects (BOs), which are pinned at allocation time, are unpinned before the function checks whether the BO is still mapped to the GPU. When the BO is still mapped, the function returns -EBUSY and leaves the BO alive even though it has already been unpinned. The BO is then unpinned a second time when it is finally freed during process teardown, triggering a ttm_bo_unpin() pin-count underflow and kernel WARNING. A local attacker with access to AMD GPU (KFD) devices could trigger this double-unpin, resulting in a memory management error, system instability, or a denial of service. Red Hat Enterprise Linux 7 and the RHEL 8.4 and 8.6 update streams are not affected because the vulnerable code is not present in those kernels. The upstream fix moves the unpin after the mapped-to-GPU check so that it only happens once the BO is committed to being freed; fixes for the affected Red Hat streams are currently deferred because the impact is limited to a kernel warning and local denial of service and the risk of regression from backporting the change outweighs the low security risk. The residual risk is a local denial of service or system instability on systems with AMD GPU hardware. Red Hat has rated this issue Moderate severity with a CVSS:3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.