CVE-2026-89808

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89808

Key Details

CVE	CVE-2026-89808
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set +

MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no

dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart()

will return an uninitialized r. That can trigger out_free_vram_pages to drop

all VRAM just set up.

Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0.

Current code postponed the last page to the final copy. This patch flushes on

the last page when reach to the end of current drm_buddy_block; avoids another

svm_migrate_copy_memory_gart. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89808
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89808

Source

Reference

NVD

CVE