CVE-2026-89813 Overview
CVE-2026-89813 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver. The flaw affects how the Kernel Interface Queue (KIQ) ring handles hardware fences during a GPU reset. The KIQ ring sets no_scheduler = true and relies on a polling fence, which caused it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). After a MODE1 reset, the first KIQ submission can poll indefinitely on a sequence number that is never written back to memory.
Critical Impact
A stale KIQ hardware fence after GPU reset causes indefinite polling on a sequence number that is never updated, leading to a driver hang on the first post-reset KIQ submission.
Affected Products
- Linux kernel drm/amdgpu driver
- Systems using AMD GPUs with KIQ ring submission
- Kernel builds prior to the fix commits bdd6a58 and fd65d17
Discovery Timeline
- 2026-09-16 - CVE-2026-89813 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-89813
Vulnerability Analysis
The vulnerability resides in the amdgpu DRM driver's GPU reset path. The KIQ ring is responsible for privileged register access and command queue management on AMD GPUs. It behaves similarly to the MES scheduler ring by setting no_scheduler = true and using a polling fence rather than an interrupt-driven completion mechanism.
During amdgpu_device_pre_asic_reset(), the driver iterates over rings and force-completes outstanding fences to bring hardware and software state back into alignment. Rings that opt out of the scheduler are excluded from this loop, leaving the KIQ ring's fence state untouched across a reset.
Root Cause
The KIQ hardware fence lives in write-back (wb) memory backed by GTT, which persists through a MODE1 reset. Meanwhile, the software counter fence_drv.sync_seq continues to advance across the reset boundary. This creates a mismatch where the hardware fence value lags behind the software sequence number. Subsequent KIQ submissions wait on a sequence that hardware will never write back.
Attack Vector
The issue is a reliability and denial-of-service condition triggered by legitimate GPU reset events rather than a directly attackable code path. A local workload that induces a GPU hang, or any system condition that triggers a MODE1 ASIC reset, can leave the KIQ ring in a state where the next submission polls forever. The result is a stalled graphics or compute pipeline until the system is rebooted.
The fix, applied in commits bdd6a58 and fd65d17, extends the force-completion logic to explicitly include the KIQ ring, ensuring its hardware fence is realigned with sync_seq after reset. See the Kernel Git Commit bdd6a58 and Kernel Git Commit fd65d17 for the upstream patches.
Detection Methods for CVE-2026-89813
Indicators of Compromise
- Kernel log entries showing amdgpu GPU reset events followed by hung task warnings referencing KIQ submissions.
- Processes blocked in kernel space waiting on amdgpu fence completion after a MODE1 reset.
- Loss of GPU responsiveness on AMD hardware following a driver-initiated recovery.
Detection Strategies
- Monitor dmesg and journal output for sequences of amdgpu reset messages followed by hung task or fence timeout warnings.
- Track kernel package versions across the fleet and flag hosts running amdgpu builds that do not include commits bdd6a58 or fd65d17.
- Correlate GPU workload failures with preceding amdgpu_device_pre_asic_reset events in system logs.
Monitoring Recommendations
- Centralize kernel logs from Linux workstations and GPU compute nodes to identify repeated reset-and-hang patterns.
- Alert on any AMD GPU driver reset event on production compute or virtualization hosts where KIQ hangs would impact tenant workloads.
- Baseline kernel versions across GPU-equipped hosts and track patch adoption against upstream stable releases.
How to Mitigate CVE-2026-89813
Immediate Actions Required
- Update to a Linux kernel release that includes commits bdd6a58743e00ebc6d52b9cdf9aafb4e535e0b71 and fd65d1742992361fc2201ecb4e43411e6e417fcb.
- Prioritize patching on systems running AMD GPU workloads where reset events are observed.
- Reboot affected hosts after applying the update to clear any stale KIQ fence state.
Patch Information
The fix extends the force-completion loop in amdgpu_device_pre_asic_reset() to include the KIQ ring, realigning its hardware fence with fence_drv.sync_seq after reset. Distribution kernels will pick up the change through backports to their supported stable branches. Consult vendor advisories for your specific kernel version and apply the corresponding update.
Workarounds
- Avoid workloads known to trigger amdgpu MODE1 resets on unpatched systems.
- Reboot the host after any observed GPU reset event to reinitialize KIQ ring state.
- Where possible, defer non-critical AMD GPU compute workloads until the patched kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
