CVE-2026-68249: Linux Kernel AMDGPU SDMA5.0 DoS Flaw

CVE-2026-68249 Overview

CVE-2026-68249 is a Linux kernel issue in the AMD GPU (amdgpu) System DMA (SDMA) 5.0 driver. The upstream commit replaces BUG_ON() calls with WARN_ON() in the drm/amdgpu/sdma5.0 code path. The original BUG_ON() invocations forced a full kernel panic on conditions that did not warrant crashing the system. Downgrading to WARN_ON() preserves diagnostic output while keeping the kernel running. The change was cherry-picked from upstream commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d and backported to multiple stable trees.

Critical Impact
Reachable BUG_ON() conditions in the amdgpu SDMA 5.0 driver can trigger a kernel panic, resulting in denial of service on systems using affected AMD graphics hardware.

Affected Products

Linux kernel builds including the drm/amdgpu driver with SDMA 5.0 support
Systems using AMD GPUs that rely on the SDMA 5.0 engine (Navi-class and later)
Stable kernel branches prior to the backported fix commits listed in the kernel.org references

Discovery Timeline

2026-08-10 - CVE-2026-68249 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68249

Vulnerability Analysis

The defect lives in the drm/amdgpu/sdma5.0 driver, which manages the SDMA engine on AMD GPUs. The driver used BUG_ON() to enforce internal invariants. BUG_ON() unconditionally triggers a kernel oops and, depending on panic_on_oops, halts the machine. The upstream maintainers determined these conditions do not require crashing the kernel. The fix replaces the macro with WARN_ON(), which logs a stack trace and allows execution to continue. This addresses an availability weakness where a triggerable path in the SDMA code could take a system offline.

Root Cause

The root cause is the use of BUG_ON() as a defensive assertion in code paths that can be reached during normal driver operation or through malformed GPU workloads. Because BUG_ON() calls panic() under common kernel configurations, any reachable condition becomes a denial-of-service primitive against the host. Refer to the kernel.org stable commit for the exact hunks removed.

Attack Vector

A local user or workload capable of submitting commands to the AMD SDMA engine through the DRM (Direct Rendering Manager) interface may drive the driver into the previously fatal assertion path. On kernels without the patch, the result is a kernel panic. On patched kernels the same condition emits a warning and the driver continues. See the referenced kernel commits for exploitation preconditions; no verified proof-of-concept code is published.

Detection Methods for CVE-2026-68249

Indicators of Compromise

Kernel panic messages referencing sdma_v5_0 or amdgpu_sdma functions in dmesg or serial console output
Unexpected host reboots or hangs on systems using AMD GPUs with active DRM workloads
BUG: lines in kernel logs originating from files under drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c

Detection Strategies

Inventory Linux hosts running unpatched kernels with the amdgpu module loaded and match versions against the fixed commits at kernel.org stable
Correlate host crash telemetry with GPU workload activity to identify SDMA-related panics
Audit kernel build configurations for CONFIG_PANIC_ON_OOPS=y, which converts these BUG_ON() hits into full system halts

Monitoring Recommendations

Forward kernel.crit and kernel.emerg syslog facilities to a centralized log store for panic-string analysis
Alert on repeated amdgpu module reload events, which often follow driver-induced crashes
Monitor uptime regressions on GPU-accelerated compute nodes and workstations

How to Mitigate CVE-2026-68249

Immediate Actions Required

Apply the fixed stable kernel that contains one of the backport commits: 0027cb1, 28337e5, 9e98ed3, d20b5c1, or f6212bc
Reboot affected hosts into the patched kernel and validate module load with modinfo amdgpu
Restrict local access to hosts exposing /dev/dri/* device nodes to trusted users only

Patch Information

The fix is a cherry-pick of upstream commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d, which converts the offending BUG_ON() sites in sdma_v5_0.c to WARN_ON(). Distribution vendors have shipped the change in the stable branches referenced above. Consult your distribution's kernel changelog for the exact package version that includes the backport.

Workarounds

Where a kernel upgrade is not immediately possible, boot with panic_on_oops=0 and oops=continue to reduce the chance that a single warning halts the host
Blacklist the amdgpu module on systems that do not require AMD GPU acceleration by adding blacklist amdgpu to /etc/modprobe.d/
Limit exposure of DRM device nodes by tightening video and render group membership

bash

# Verify running kernel does not contain the vulnerable BUG_ON() path
uname -r
grep -R "BUG_ON" /usr/src/linux-$(uname -r)/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c || echo "patched"

# Reduce blast radius until patched kernel is deployed
echo 0 > /proc/sys/kernel/panic_on_oops