CVE-2026-63880: Linux Kernel AMDGPU DoS Vulnerability

CVE-2026-63880 Overview

CVE-2026-63880 is a Linux kernel vulnerability in the AMD GPU (amdgpu) Direct Rendering Manager (DRM) driver. The flaw resides in the AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl(), where a memory allocation failure path leaks three cleanup-tracked resources. When kvcalloc() returns -ENOMEM, the code returns directly instead of jumping to the out_exec label, leaving a GEM object reference and two drm_exec locks held. The leaked per-process VM root page directory dma_resv lock blocks all subsequent operations on the same VM context. The DRM_IOCTL_AMDGPU_GEM_OP ioctl is marked DRM_AUTH | DRM_RENDER_ALLOW, so any unprivileged process with access to /dev/dri/renderD* can trigger the condition.

Critical Impact
Unprivileged local users can permanently hang GPU contexts, leaving affected processes in uninterruptible D state until reboot.

Affected Products

Linux kernel amdgpu DRM driver
Systems using AMD Radeon graphics with the affected kernel versions
Confirmed reproduced on kernel 7.0.0-10 with Ryzen 7 5700U / Radeon Vega (Lucienne)

Discovery Timeline

2026-07-19 - CVE-2026-63880 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63880

Vulnerability Analysis

The vulnerability is a memory leak and lock leak [CWE-401 / CWE-667] in the AMD GPU kernel driver. The AMDGPU_GEM_OP_GET_MAPPING_INFO branch acquires three cleanup-tracked resources before allocating memory: a drm_gem_object reference from drm_gem_object_lookup(), a drm_exec lock on the GEM object via drm_exec_lock_obj(), and a drm_exec lock on the per-process VM root page directory via amdgpu_vm_lock_pd().

Every normal error path in the function jumps to the out_exec label, which releases all three resources through drm_exec_fini() and drm_gem_object_put(). The kvcalloc() allocation failure path, however, returns -ENOMEM directly and skips the cleanup entirely. The critical impact comes from the leaked VM root PD dma_resv lock, which blocks all subsequent GEM operations, command submissions, evictions, and TTM shrinker callbacks on the same VM.

Root Cause

The root cause is an incomplete error-handling path. The developer failed to route the kvcalloc() failure through the shared cleanup label. Because the leaked lock is a per-process VM lock, even process termination cannot recover the state — the fd-release path calls amdgpu_gem_object_close(), which invokes drm_exec_prepare_obj() on the same held lock and blocks indefinitely.

Attack Vector

Exploitation requires only local access to /dev/dri/renderD*, which is typically granted to any authenticated user or unprivileged rendering client. An attacker triggers the bug by issuing a DRM_IOCTL_AMDGPU_GEM_OP ioctl with the AMDGPU_GEM_OP_GET_MAPPING_INFO opcode under memory pressure conditions that force kvcalloc() to fail. A second GET_MAPPING_INFO call on the same file descriptor then blocks in drm_exec_lock_obj() on the leaked dma_resv. SIGKILL on the caller does not reap the task, leaving it stuck in uninterruptible D state until reboot.

Detection Methods for CVE-2026-63880

Indicators of Compromise

Processes stuck in uninterruptible sleep (D state) with stack traces referencing drm_exec_lock_obj, amdgpu_gem_object_close, or drm_exec_prepare_obj
-ENOMEM return codes from DRM_IOCTL_AMDGPU_GEM_OP ioctls followed by process hangs
GPU workloads hanging indefinitely on systems running affected amdgpu driver versions

Detection Strategies

Monitor kernel logs for hung task warnings referencing amdgpu_gem_op_ioctl or drm_exec symbols
Audit processes accessing /dev/dri/renderD* and correlate with abnormal task state transitions
Track repeated AMDGPU_GEM_OP ioctl failures from unprivileged processes as a potential trigger pattern

Monitoring Recommendations

Enable hung_task_timeout_secs kernel monitoring and alert on tasks blocked longer than the threshold
Collect /proc/<pid>/stack for processes in D state to identify DRM lock contention
Log memory pressure events (OOM, high MemAvailable churn) that could trigger kvcalloc() failures

How to Mitigate CVE-2026-63880

Immediate Actions Required

Apply the upstream kernel patches that route the kvcalloc() failure through the out_exec cleanup label
Update to a stable kernel release that includes commit b69d3256d79de15f54c322986ff4da68f1d65b0a or its backports
Restrict access to /dev/dri/renderD* on multi-tenant systems where unprivileged local users are untrusted

Patch Information

The upstream fix routes the -ENOMEM failure path through the out_exec label so that drm_exec_fini() and drm_gem_object_put() execute correctly. Stable-tree backports are available in the following commits: Kernel Git Commit 1eb86334, Kernel Git Commit 2e7f55eb, and Kernel Git Commit 8f643d53.

Workarounds

Tighten permissions on /dev/dri/renderD* device nodes to limit exposure to trusted rendering clients only
Reduce memory pressure on affected systems to lower the probability of kvcalloc() failure
Reboot affected systems to clear hung GPU contexts, as the leaked lock cannot be released without a restart

bash

# Verify kernel version and confirm the fix is present
uname -r

# Restrict render node access to a specific group
sudo chown root:render /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128

# Monitor for hung tasks caused by the leaked dma_resv lock
sudo dmesg -w | grep -Ei 'hung_task|amdgpu_gem|drm_exec'