PT-2026-47348 · Linux · Linux
Published
2026-06-08
·
Updated
2026-06-08
·
CVE-2026-46276
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix zero-size GDS range init on RDNA4
RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory
resources. The gfx v12 0 initialisation code correctly leaves
adev->gds.gds size, adev->gds.gws size, and adev->gds.oa size at
zero to reflect this.
amdgpu ttm init() unconditionally calls amdgpu ttm init on chip() for
each of these resources regardless of size. When the size is zero,
amdgpu ttm init on chip() forwards the call to ttm range man init(),
which calls drm mm init(mm, 0, 0). drm mm init() immediately fires
DRM MM BUG ON(start + size <= start) -- trivially true when size is
zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT.
Guard against this by returning 0 early from
amdgpu ttm init on chip() when size in page is zero. This skips TTM
resource manager registration for hardware resources that are absent,
without affecting any other GPU type.
DRM MM BUG ON() only asserts if CONFIG DRM DEBUG MM is enabled in
the kernel config. This is apparently rarely enabled as these chips
have been in the market for over a year and this issue was only reported
now.
Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html
(cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux