CVE-2026-89827: Linux Kernel UVD Privilege Escalation

CVE-2026-89827 Overview

CVE-2026-89827 affects the Linux kernel's AMD GPU driver (drm/amdgpu). The flaw resides in the Universal Video Decoder (UVD) subsystem, specifically in how the driver handles fence completion during resume operations on Single Root I/O Virtualization (SR-IOV) Virtual Functions (VF).

The function uvd_v7_0_sw_init() does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpu_uvd_resume() unconditionally force-completes the decode ring when restoring its fence sequence. This causes the kernel to operate on an uninitialized fence driver, leading to instability in virtualized AMD GPU environments.

Critical Impact
The vulnerability can trigger kernel instability or crashes in SR-IOV virtualized environments running AMD UVD-capable GPUs during resume operations.

Affected Products

Linux Kernel (drm/amdgpu driver)
AMD GPUs with UVD v7.0 support running under SR-IOV Virtual Functions
Virtualized environments using AMD GPU passthrough with SR-IOV

Discovery Timeline

2026-09-16 - CVE-2026-89827 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89827

Vulnerability Analysis

The vulnerability exists in the AMD GPU kernel driver's UVD handling code path. When the driver initializes on an SR-IOV Virtual Function, uvd_v7_0_sw_init() intentionally skips setting up the decode ring because VFs do not use it directly. The fence driver associated with that ring therefore remains uninitialized.

During a resume operation, amdgpu_uvd_resume() iterates over UVD rings and force-completes any pending fence sequences to restore state. The code did not check whether the fence driver for a given ring was actually initialized before performing this operation. Accessing uninitialized fence driver structures results in undefined behavior within kernel context.

The fix, applied in commits 6760f5cb12d2 and 967a179463d3, adds a check to skip fence completion when the fence driver is not initialized.

Root Cause

The root cause is missing state validation before operating on kernel data structures. The resume path assumed all UVD rings were initialized during software init, but the SR-IOV VF code path skips decode ring setup. This inconsistency between initialization and resume logic represents an Uninitialized Memory Use condition in the kernel driver.

Attack Vector

Exploitation requires local access to a virtualized guest with an assigned AMD GPU SR-IOV Virtual Function. The condition is triggered by driver resume events, such as power management transitions or GPU reset cycles. The vulnerability primarily manifests as a Denial of Service condition affecting availability of the virtualized GPU resource and potentially the guest kernel.

See the Linux Kernel Commit 6760f5c and Linux Kernel Commit 967a179 for the specific code changes.

Detection Methods for CVE-2026-89827

Indicators of Compromise

Kernel panics or oops messages referencing amdgpu_uvd_resume in system logs
Unexpected GPU driver crashes on SR-IOV VF guests during resume or power state transitions
dmesg entries showing fence driver errors tied to UVD rings on AMD GPUs

Detection Strategies

Monitor kernel logs on virtualized hosts and guests using AMD GPU passthrough for stack traces involving amdgpu and uvd_v7_0
Inventory running kernel versions across virtualized infrastructure and cross-reference with patched stable kernel releases
Correlate GPU driver crash events with SR-IOV VF assignments to identify affected workloads

Monitoring Recommendations

Enable kernel crash dump collection (kdump) on hosts using AMD SR-IOV GPUs to capture diagnostic data
Forward kernel and hypervisor logs to a centralized logging platform for correlation and alerting
Track GPU driver version and kernel build metadata across the fleet to identify unpatched systems

How to Mitigate CVE-2026-89827

Immediate Actions Required

Identify all Linux systems running virtualized workloads with AMD GPUs configured for SR-IOV
Apply the upstream kernel patches from commits 6760f5cb12d2 and 967a179463d3, or upgrade to a stable kernel release that includes them
Schedule maintenance windows to reboot affected guests after kernel updates

Patch Information

The fix is available in the mainline Linux kernel through two commits. The patch modifies amdgpu_uvd_resume() to skip fence completion when the fence driver is not initialized, preventing operations on uninitialized ring state. Consult your Linux distribution vendor for backported stable kernel packages that include these commits.

Workarounds

Avoid GPU driver resume or reset cycles on affected SR-IOV VF guests until patches are applied
Where feasible, unbind the amdgpu driver on VF guests that do not require UVD decode functionality
Isolate affected virtualized workloads on hosts that do not experience frequent power management events

bash

# Verify installed kernel version and check for the fix
uname -r
git log --oneline v5.15.. -- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | \
  grep -E "6760f5cb12d2|967a179463d3"

# Check for amdgpu UVD-related messages in kernel log
dmesg | grep -iE "amdgpu|uvd"