CVE-2026-89828

CVE CVE-2026-89828EUVD EUVD-2026-80428Published 2026-09-16T10:31:00.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function returns early and bypasses those initializations. Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init() is called, a failure triggers amdgpu_ttm_fini(), which calls amdgpu_vram_mgr_fini(), which then: - Calls list_for_each_entry_safe() on reservations_pending and reserved_pages, whose list_head::next pointers are zero-initialized (NULL). The loop does not recognize them as empty and dereferences NULL. - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally via for_each_free_tree(). Since mm->free_trees is NULL (never allocated), this dereferences NULL. Both result in a kernel panic on the module load error path. Fix by moving drmm_cgroup_register_region() to after the list and buddy allocator are fully initialized, so the teardown path is safe to run.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 2b624a2c18656ea32e0849e7bc0018ba3c97ca64 <e184e46ca1ba652ab8053a10a51b39aad06d3f5c; patch: 7.2.5; 2b624a2c18656ea32e0849e7bc0018ba3c97ca64 <e773798e14ac0aea54ca9676083b91f445e5bc59; 2b624a2c18656ea32e0849e7bc0018ba3c97ca64 <3e234c6face8651045f46895dfe9c086ea64f03b; patch: 7.3-rc1; 6.14; patch: 0; patch: 6.18.51

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.