CVE-2026-45979: Linux Kernel AMDGPU Memory Vulnerability

CVE-2026-45979 Overview

CVE-2026-45979 affects the Linux kernel's AMD GPU Direct Rendering Manager (DRM) driver. The flaw resides in the amdgpu_cs_parser_bos function, which prepares buffer object lists during command submission. Under low memory conditions, a kmalloc allocation can fail, causing the function to return without unlocking a previously acquired mutex. This leaves the lock held indefinitely, producing a kernel resource leak that can lead to deadlock or denial of service. Kernel maintainers resolved the issue by adding an unlock on the failure path while removing a redundant amdgpu_bo_list_put call already handled by amdgpu_cs_parser_fini.

Critical Impact
A failed memory allocation in the amdgpu command submission path leaves a mutex locked, enabling local denial of service against systems using AMD GPU hardware.

Affected Products

Linux kernel versions containing the amdgpu_cs_parser_bos implementation prior to the upstream fix
Distributions shipping the AMD GPU DRM driver (drm/amdgpu)
Workstations and servers with AMD discrete or integrated graphics

Discovery Timeline

2026-05-27 - CVE-2026-45979 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45979

Vulnerability Analysis

The defect is a kernel resource leak in the AMD GPU DRM driver's command submission parser. The function amdgpu_cs_parser_bos acquires a mutex before allocating memory with kmalloc to manage buffer object lists. When the system is under memory pressure, kmalloc returns NULL. The original error path returned from the function without releasing the mutex, leaving the lock permanently held.

Any subsequent caller attempting to acquire the same mutex blocks indefinitely. This produces a denial of service condition affecting graphics command submission and any kernel path that depends on the contended lock.

Root Cause

The root cause is improper error-path cleanup in the amdgpu_cs_parser_bos function. The code acquired a mutex and then performed an allocation that could fail, but the failure branch lacked the corresponding mutex_unlock call. The fix unlocks the mutex on the failure path for a clean exit. The patch also removes a redundant amdgpu_bo_list_put call because the buffer object list cleanup is already performed by amdgpu_cs_parser_fini.

Attack Vector

Exploitation requires a local context capable of submitting commands to the AMD GPU through DRM ioctls. An unprivileged user with access to the render node can issue command submissions while the system experiences memory pressure. Triggering the allocation failure leaves the mutex held, blocking further GPU command submission and degrading system stability. No remote attack vector exists for this defect.

No verified public exploitation code is available. See the upstream commits at Kernel Git Commit 0905a1d4 and Kernel Git Commit f025a2b8 for the resolved code paths.

Detection Methods for CVE-2026-45979

Indicators of Compromise

Processes stuck in uninterruptible sleep (D state) waiting on AMD GPU driver mutexes
Kernel hung_task warnings referencing amdgpu_cs_parser_bos or related DRM symbols
Sustained graphics subsystem unresponsiveness following out-of-memory events

Detection Strategies

Monitor dmesg and /var/log/kern.log for hung task messages and stack traces pointing into drm/amdgpu
Compare running kernel version against the fixed commits referenced in stable kernel updates
Track allocation failure rates via /proc/vmstat and correlate with GPU subsystem stalls

Monitoring Recommendations

Enable CONFIG_DETECT_HUNG_TASK and review the hung_task_timeout_secs threshold on systems with AMD GPUs
Collect kernel crash dumps and stack traces from production hosts running graphics workloads
Alert on repeated kmalloc failures combined with DRM subsystem warnings in centralized log pipelines

How to Mitigate CVE-2026-45979

Immediate Actions Required

Apply the stable kernel update containing the amdgpu_cs_parser_bos cleanup fix
Identify hosts using the AMD GPU driver with lsmod | grep amdgpu and prioritize patching
Reboot systems after kernel upgrades to load the patched module

Patch Information

The fix is committed upstream in the Linux kernel stable tree. Reference Kernel Git Commit 0905a1d4 and Kernel Git Commit f025a2b8. The patch adds the missing mutex_unlock on the kmalloc failure path and removes the redundant amdgpu_bo_list_put call already handled by amdgpu_cs_parser_fini. Consume the fix through your distribution's kernel update channel.

Workarounds

Reduce memory pressure by tuning workloads and increasing available RAM or swap on affected hosts
Restrict local access to DRM render nodes (/dev/dri/renderD*) to trusted users where feasible
Where graphics acceleration is not required, blacklist the amdgpu module until patching is complete

bash

# Verify running kernel and amdgpu module status
uname -r
lsmod | grep amdgpu

# Apply distribution kernel updates (example: Debian/Ubuntu)
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot