CVE-2026-63879

Received Received - Intake

AMDGPU Memory Management Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the common define for 2G range. (cherry picked from commit c08972f555945cda57b0adb72272a37910153390)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63879

EUVD

EUVD-2026-45764

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the amdgpu driver's memory management function, amdgpu_hmm_range_get_pages. The issue occurs when a notifier sequence is read more than once, potentially leading to the use of invalid memory pages. The fix ensures the notifier is read only once and improves coding style by removing pre-initialized return values and using standard definitions.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDGPU driver and does not have network-based detection methods. To check for affected systems, verify if your kernel version includes the vulnerable code by examining the AMDGPU driver source or running kernel version checks. Commands like 'uname -a' or 'modinfo amdgpu' may help identify the kernel and driver version.

Impact Analysis

This vulnerability could lead to system instability or crashes if the amdgpu driver processes invalid memory pages due to repeated notifier reads. Users relying on AMD GPUs with affected Linux kernel versions may experience graphical issues, application failures, or kernel panics.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-63879. Check your distribution's security advisories for the patched kernel release.

Hi! I’m here to help you understand CVE-2026-63879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70