CVE-2026-89810

A flaw was found in the Linux kernel's drm/amdkfd component. When page migration from a device to system RAM fails, the driver incorrectly uses a DMA (Direct Memory Access) address instead of a physical address to release and unlock allocated system pages. This improper handling of memory resources, especially when an IOMMU (Input/Output Memory Management Unit) is enabled, can lead to system instability or resource exhaustion.

svm_migrate_copy_to_ram can release and unlock the wrong system RAM page on an error path because the old code derived struct page from a DMA address instead of the real page identity. With IOMMU enabled, or in general when DMA addresses differ from physical PFNs, this can corrupt page reference state, leave the real migration page locked or leaked, and create a use-after-free candidate. For the CVSS the PR:L is used because a local user with access to AMD KFD GPU compute or the render device may be able to trigger SVM migration paths without full administrator privileges. AC:H is used because reliable triggering depends on reaching a migration failure path such as dma_map_page() or copy failure. The issue is not network reachable. Impact is at least local denial of service through page state corruption or resource leakage, and in the paranoid case may include confidentiality and integrity impact due to wrong page release and possible memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.