CVE-2026-80618
Received Received - Intake

Double-Unpin Bug in Linux Kernel AMDKFD

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned DOORBELL and MMIO remap BOs (which are pinned at allocation time) before checking whether the BO is still mapped to the GPU. When the BO is still mapped, the function returns -EBUSY and leaves the BO alive, but it has already been unpinned. The BO is then unpinned again when it is finally freed during process teardown, triggering a ttm_bo_unpin() underflow warning: WARNING: CPU: 18 PID: 15066 at ttm/ttm_bo.c:650 amdttm_bo_unpin+0x6d/0x80 [amdttm] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu] RIP: 0010:amdttm_bo_unpin+0x6d/0x80 [amdttm] Call Trace: amdgpu_bo_unpin+0x1a/0x90 [amdgpu] amdgpu_amdkfd_gpuvm_unpin_bo+0x31/0xb0 [amdgpu] amdgpu_amdkfd_gpuvm_free_memory_of_gpu+0x3bf/0x460 [amdgpu] kfd_process_free_outstanding_kfd_bos+0xd4/0x170 [amdgpu] kfd_process_wq_release+0x109/0x1b0 [amdgpu] process_one_work+0x1e2/0x3b0 worker_thread+0x50/0x3a0 kthread+0xdd/0x100 ret_from_fork+0x29/0x50 Move the unpin after the mapped_to_gpu_memory check so it only happens once we are committed to freeing the BO. (cherry picked from commit 927c5b2defb9b09856444d94bebfd056a002bd75)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-80618
EUVD
EUVD-2026-67494

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
amd amdgpu *
amd linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double-unpin issue in the AMDKFD driver. When a GPU memory buffer is freed, the function unpins doorbell and MMIO buffers before checking if they are still mapped to the GPU. If the buffer is still mapped, the function returns an error but leaves the buffer unpinned. Later, during process teardown, the buffer is unpinned again, causing a warning due to an underflow in the ttm_bo_unpin function.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD GPU driver (amdgpu) and may not have direct network detection methods. Check kernel logs for ttm_bo_unpin() underflow warnings or errors related to amdgpu_amdkfd_gpuvm_free_memory_of_gpu(). Use commands like dmesg | grep -i ttm or journalctl -k | grep -i amdgpu to inspect system logs for related errors.

Impact Analysis

This vulnerability may cause system instability or warnings during GPU memory management, particularly when running AMD GPU workloads. It could lead to kernel warnings or errors during process termination, but does not directly impact user data or security.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. Monitor kernel updates from your distribution and apply them promptly. If you cannot update immediately, consider disabling the AMD GPU kernel module (amdgpu) if not in use, but this may impact graphics functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart