CVE-2026-89828: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89828 Overview

CVE-2026-89828 is a NULL pointer dereference vulnerability in the Linux kernel's AMD GPU (amdgpu) driver. The flaw resides in amdgpu_vram_mgr_init(), where drmm_cgroup_register_region() is invoked before critical initialization routines run. When the cgroup registration fails, the function returns early, leaving list heads zero-initialized and the buddy allocator unallocated. The subsequent teardown path calls amdgpu_vram_mgr_fini(), which dereferences these NULL pointers and triggers a kernel panic on the module load error path.

Critical Impact
Failed initialization of the amdgpu VRAM manager triggers a kernel panic during module load, resulting in a denial-of-service condition on systems with AMD graphics hardware.

Affected Products

Linux kernel builds containing the drm/amdgpu VRAM manager with drmm_cgroup_register_region() integration
Distributions shipping affected amdgpu driver revisions prior to the referenced stable commits
Systems using AMD GPUs that load the amdgpu kernel module

Discovery Timeline

2026-09-16 - CVE-2026-89828 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89828

Vulnerability Analysis

The vulnerability exists in the AMD GPU driver's VRAM manager initialization sequence. The function amdgpu_vram_mgr_init() calls drmm_cgroup_register_region() before invoking INIT_LIST_HEAD() on the reservations_pending and reserved_pages lists, and before calling gpu_buddy_init() to allocate the free-tree structures.

Because adev->mman.initialized is set to true prior to amdgpu_vram_mgr_init(), any failure inside that function propagates into a cleanup path via amdgpu_ttm_fini(). That teardown routine calls amdgpu_vram_mgr_fini(), which assumes the manager reached a fully initialized state.

Root Cause

The root cause is an ordering defect between resource registration and structure initialization [CWE-476]. When drmm_cgroup_register_region() fails, list_for_each_entry_safe() iterates over lists whose list_head::next pointers remain NULL, and for_each_free_tree() walks a free_trees[] array that was never allocated. Both operations dereference NULL memory.

Attack Vector

Exploitation requires the amdgpu module to fail during load, which is triggered by resource-constrained or misconfigured cgroup environments rather than remote input. The impact is a local denial of service through a kernel panic. There is no evidence of remote exploitability, and no public proof-of-concept has been published for this issue.

See the upstream fix in the Kernel Git Commit 3e234c6 for the corrected initialization order.

Detection Methods for CVE-2026-89828

Indicators of Compromise

Kernel panic messages referencing amdgpu_vram_mgr_fini, gpu_buddy_fini, or list_for_each_entry_safe during module load
dmesg output showing amdgpu initialization failure followed by an oops with a NULL pointer dereference in drm/amdgpu symbols
System boot failures or GPU service unavailability on hosts running affected kernel versions

Detection Strategies

Inventory running kernel versions and compare against the fixed commits referenced in the stable tree
Monitor kernel crash dumps and kdump collections for panic signatures involving amdgpu_vram_mgr_* functions
Alert on repeated amdgpu module load failures in system journals across managed Linux endpoints

Monitoring Recommendations

Forward dmesg and journald logs to a centralized data lake to correlate kernel oops events with affected host inventories
Track module load status via lsmod and systemd unit health checks on GPU-equipped nodes
Establish baseline alerts for kernel panics on production servers and workstations using AMD graphics hardware

How to Mitigate CVE-2026-89828

Immediate Actions Required

Update the Linux kernel to a stable release containing the initialization-order fix
Reboot affected systems after applying the updated kernel package
Validate that the amdgpu module loads cleanly and no panic occurs in dmesg output

Patch Information

The fix moves drmm_cgroup_register_region() to after the list heads and buddy allocator are fully initialized, ensuring the teardown path operates on valid structures. Corrected code is available in the following stable-tree commits: Kernel Git Commit 3e234c6, Kernel Git Commit e184e46, and Kernel Git Commit e773798e.

Workarounds

Blacklist the amdgpu module on systems where GPU functionality is not required until patched kernels are deployed
Avoid cgroup configurations that induce drmm_cgroup_register_region() failure while patching is pending
Restrict physical and administrative access to affected hosts to reduce the risk of triggering module reload panics

bash

# Verify current kernel version and check for the fixed amdgpu module
uname -r
modinfo amdgpu | grep -E 'version|srcversion'
dmesg | grep -Ei 'amdgpu|vram_mgr'