CVE-2026-45853: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45853 Overview

CVE-2026-45853 is a memory corruption vulnerability in the Linux kernel's AMD GPU (amdgpu) driver. The flaw resides in amdgpu_gmc_get_nps_memranges(), which incorrectly used kfree() to release memory allocated by amdgpu_discovery_get_nps_info(). That allocation uses kvcalloc(), which may fall back to vmalloc() for large allocations. Releasing vmalloc-backed memory with kfree() corrupts kernel memory state. The issue was identified through a prototype static analysis tool and code review, and the fix replaces kfree() with kvfree() to safely handle both kmalloc and vmalloc allocations.

Critical Impact
Improper deallocation of vmalloc-backed memory in the amdgpu driver can corrupt kernel memory, potentially causing system instability, crashes, or undefined behavior on systems with AMD GPUs.

Affected Products

Linux kernel versions containing the amdgpu_gmc_get_nps_memranges() function prior to the fix
Systems using AMD discrete or integrated GPUs with the amdgpu driver
Distributions shipping unpatched mainline or stable kernels referenced in the upstream commits

Discovery Timeline

2026-05-27 - CVE-2026-45853 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45853

Vulnerability Analysis

The vulnerability resides in the AMD GPU graphics driver subsystem of the Linux kernel. Inside amdgpu_gmc_get_nps_memranges(), the driver requests NUMA Per-Socket (NPS) memory range data through amdgpu_discovery_get_nps_info(). That helper allocates the ranges buffer using kvcalloc(), an allocator that transparently chooses between slab and virtually contiguous memory.

For small requests, kvcalloc() returns slab memory via kmalloc(). For larger requests, it falls back to vmalloc(), returning a virtually contiguous mapping outside the slab allocator. The caller previously freed the returned pointer with kfree(), which is only valid for slab allocations.

When the underlying buffer originated from vmalloc(), passing it to kfree() corrupts kernel metadata. The result is memory corruption that may manifest as slab cache poisoning, kernel panics, or unpredictable behavior in unrelated subsystems.

Root Cause

The root cause is an allocator mismatch [CWE-762]. The producer uses kvcalloc(), which may return memory from either slab or vmalloc backends. The consumer used kfree(), which only accepts slab-backed pointers. Correct cleanup requires kvfree(), the dual of kvmalloc-family allocators.

Attack Vector

The defect requires a code path that triggers amdgpu_gmc_get_nps_memranges() with an NPS memory range table large enough for kvcalloc() to fall back to vmalloc(). The trigger depends on hardware discovery data exposed by the GPU and platform. Exploitation as a remote or unprivileged attack vector is not documented. The reporter notes the issue was found through static analysis and was compile-tested only, with no in-the-wild exploitation reported.

The vulnerability manifests as kernel memory corruption rather than direct user-controlled code execution. See the upstream commits for the precise call path and patched code.

Detection Methods for CVE-2026-45853

Indicators of Compromise

Kernel log entries referencing slab corruption, BUG: unable to handle, or kernel BUG at mm/ shortly after amdgpu initialization
Unexpected kernel panics on systems with AMD GPUs during driver load or GPU discovery
dmesg warnings citing kfree() on non-slab addresses or general protection faults inside amdgpu_gmc functions

Detection Strategies

Inventory running kernels and cross-reference against the patched commits: 0c44d61945c4, 16e7e7ad8cdc, 9ae85b0c1909, and f441538893eb
Enable CONFIG_DEBUG_VM, KASAN, or SLUB_DEBUG on test systems to surface allocator mismatches in the amdgpu path
Monitor crash dumps and kdump output for stack traces involving amdgpu_gmc_get_nps_memranges or amdgpu_discovery_get_nps_info

Monitoring Recommendations

Forward kernel logs from AMD GPU hosts to a centralized log platform and alert on panics, oopses, and slab corruption events
Track package versions of the kernel across the fleet and flag hosts running unpatched builds
Correlate GPU driver crash signatures across hosts to identify systematic exposure rather than isolated hardware faults

How to Mitigate CVE-2026-45853

Immediate Actions Required

Apply the upstream kernel patches that replace kfree() with kvfree() in amdgpu_gmc_get_nps_memranges()
Update to a distribution kernel that includes the fix from stable kernel commits referenced by the Linux kernel stable tree
Reboot affected systems after patching so the corrected driver is loaded

Patch Information

The fix is committed across multiple stable kernel branches. See the upstream change records: commit 0c44d61945c4, commit 16e7e7ad8cdc, commit 9ae85b0c1909, and commit f441538893eb. The functional change is a one-line replacement of kfree(ranges) with kvfree(ranges).

Workarounds

Where patching is not immediately possible, avoid loading the amdgpu driver on non-essential systems by blacklisting it until the kernel is updated
On systems that do not require GPU acceleration, boot with modprobe.blacklist=amdgpu to prevent the vulnerable code path from executing
Restrict physical and administrative access to affected hosts until the patched kernel is deployed

bash

# Verify running kernel version and check for the amdgpu module
uname -r
lsmod | grep amdgpu

# Temporary mitigation: blacklist the amdgpu driver until patched kernel is installed
echo 'blacklist amdgpu' | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u

# Apply vendor kernel update (Debian/Ubuntu example)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot