CVE-2026-63879: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63879 Overview

CVE-2026-63879 is a race condition vulnerability in the Linux kernel amdgpu Direct Rendering Manager (DRM) driver. The flaw resides in the amdgpu_hmm_range_get_pages function, where the Heterogeneous Memory Management (HMM) notifier sequence was read multiple times. Reading the sequence more than once allows the driver to operate on invalid pages, producing memory corruption conditions on systems using AMD graphics hardware.

The issue affects local attackers with low privileges who can interact with the AMD GPU driver interface. Successful exploitation impacts confidentiality, integrity, and availability of the affected host.

Critical Impact
A local, low-privileged user can trigger a race in the AMD GPU HMM code path leading to use of invalid memory pages, potentially resulting in kernel memory corruption and privilege escalation.

Affected Products

Linux kernel builds that include the drm/amdgpu driver prior to the fix commit c08972f555945cda57b0adb72272a37910153390
Distribution kernels shipping the AMD GPU driver with the vulnerable amdgpu_hmm_range_get_pages implementation
Systems using AMD discrete or integrated GPUs relying on HMM for shared virtual memory

Discovery Timeline

2026-07-19 - CVE-2026-63879 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63879

Vulnerability Analysis

The vulnerability exists in the amdgpu_hmm_range_get_pages function within the AMD GPU DRM driver. HMM uses a notifier sequence number to detect concurrent modifications to a memory range while the driver walks page tables and populates page pointers. Correct usage requires reading the sequence exactly once and then validating it after the page walk completes.

The vulnerable code path read the notifier sequence more than once during the range setup. When the sequence was re-read after concurrent invalidation, the driver could proceed with page pointers that had already been unmapped or freed. The result is that the GPU driver operates on invalid or stale pages, corrupting kernel memory or exposing freed data to the device.

Because the impact spans confidentiality, integrity, and availability, and requires only local access with limited privileges, this class of kernel race is commonly used as a stepping stone toward local privilege escalation on multi-tenant Linux systems.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) style race condition in the HMM integration inside amdgpu. The notifier sequence, which serves as the synchronization primitive between the memory subsystem and the GPU driver, was consumed multiple times. This broke the invariant required by mmu_interval_read_begin and mmu_interval_read_retry, permitting the driver to accept a page array that no longer reflected the current state of the process address space.

Attack Vector

Exploitation requires local access and the ability to issue GPU ioctls against the amdgpu driver. An attacker crafts workloads that repeatedly map, unmap, and access memory ranges shared with the GPU while triggering HMM range queries. Winning the race causes the driver to reference pages that have been reclaimed or reassigned, which can be leveraged to read or corrupt kernel data structures.

The vulnerability was resolved in the upstream patch cherry-picked as commit c08972f555945cda57b0adb72272a37910153390, with stable backports available in commits 2fd24407457a6b181ba827705678da70e528dcd0 and 962d684b5dc0741dcd93485d41b450de402d5592. Refer to the Kernel Git Commit 2fd2440 and Kernel Git Commit 962d684 for the exact source-level fix.

Detection Methods for CVE-2026-63879

Indicators of Compromise

Unexpected kernel oops or BUG: entries in dmesg referencing amdgpu_hmm_range_get_pages or nearby HMM helper functions
Page fault traces involving amdgpu DRM ioctl paths on hosts with AMD graphics hardware
Local processes issuing high-frequency DRM_IOCTL_AMDGPU_* calls combined with rapid mmap/munmap cycles on shared virtual memory regions

Detection Strategies

Inventory Linux hosts running kernels that predate the stable backport commits and flag those still exposing the amdgpu driver to unprivileged users
Monitor kernel logs for repeated GPU driver faults, HMM-related warnings, or mmu_interval_notifier retry storms originating from a single UID
Correlate DRM ioctl activity with process behavior to identify non-graphical workloads exercising GPU memory management paths

Monitoring Recommendations

Ingest /var/log/kern.log and journald kernel messages into a centralized analytics pipeline and alert on amdgpu crash signatures
Track kernel package versions across the fleet and generate alerts when hosts drift below the patched build
Enable auditd rules for ioctl syscalls targeting /dev/dri/renderD* and /dev/dri/card* device nodes from unexpected user contexts

How to Mitigate CVE-2026-63879

Immediate Actions Required

Apply the stable kernel update that contains commits 2fd24407457a6b181ba827705678da70e528dcd0 and 962d684b5dc0741dcd93485d41b450de402d5592 from your Linux distribution vendor
Reboot affected systems after installing the updated kernel to load the fixed amdgpu module
Restrict access to /dev/dri/* device nodes to trusted users and service accounts until patches are deployed

Patch Information

The fix originates from upstream commit c08972f555945cda57b0adb72272a37910153390, which restructures amdgpu_hmm_range_get_pages to read the notifier sequence exactly once, removes the pre-initialized return value, and uses the common define for the 2G range. Stable-tree backports are available in the referenced kernel.org commits. Apply the distribution kernel that includes these commits.

Workarounds

Unload the amdgpu kernel module on systems that do not require AMD GPU acceleration using modprobe -r amdgpu and blacklist it via /etc/modprobe.d/
Limit interactive local access on servers using AMD graphics until the patched kernel is deployed
Apply tighter Discretionary Access Control (DAC) permissions on DRM render nodes to reduce the population of users able to reach the vulnerable code path

bash

# Verify the running kernel and amdgpu module status, then blacklist if unused
uname -r
lsmod | grep amdgpu
echo 'blacklist amdgpu' | sudo tee /etc/modprobe.d/disable-amdgpu.conf
sudo update-initramfs -u