Linux kernel amdgpu vblank counter reads race with GPU reset
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 7 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
The amdgpu display driver in the Linux kernel, from 4.2, reads the vblank counter and scanout position without holding the GPU reset semaphore. During GPU recovery, display commit work can call these reads while reset holds the semaphore for writing, which triggers a kernel warning and taints the kernel when lockdep is enabled. The flaw was resolved by taking the semaphore for reading before hardware access and returning the cached software count when reset is in progress.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the callback while reset owns the semaphore for writing. The hardware access then triggers the lockdep_assert_held() in amdgpu_device_skip_hw_access() and sets TAINT_WARN when lockdep is enabled. Try to acquire the reset semaphore for reading before accessing the hardware, and hold it across the counter and scanout-position reads. If reset is already in progress, return DRM's cached software vblank count instead. This avoids blocking behind reset and avoids accessing display hardware while it is being reset. The cached count is less accurate than the hardware count, but is used only when reset prevents a safe hardware read. This addresses the reset-time warning from this vblank path; it does not suppress or fix unrelated lockdep warnings. (cherry picked from commit 51a4359f7431a4be5e42803c8bdaf7e0e5be2934)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Update the Linux kernel to 6.6.160, 6.12.113, 6.18.57, 7.2.11 or 7.3, or a later release in the same branch. Red Hat lists Red Hat Enterprise Linux 6 with no fix planned, and Red Hat Enterprise Linux 7, 8, 9, 10, Red Hat OpenShift Container Platform 4 and Red Hat OpenShift Container Platform 5 with no fix available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Linux (Linux) Fixed in 6.6.160, 6.12.113, 6.18.57, 7.2.11, 7.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-26 Threatist record created from CVE-2026-99090
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-27 CVSS score added · Red Hat
- 2026-10-27 Fix available: Linux/Linux@0 · CNA
- 2026-10-27 Alias added: GHSA-3hrf-vpmj-gj4m
- 2026-11-06 Affected versions changed · Red Hat
References
Other 5
- https://git.kernel.org/stable/c/037796d9ca1da97978deaefd88ca5649f6cb69f5
- https://git.kernel.org/stable/c/11b6193c8841a052b7907006ffb1e02468b1448e
- https://git.kernel.org/stable/c/8d6f773d7479034a574ecc3b585bcd07d46b4824
- https://git.kernel.org/stable/c/f4a0a1ce147d1a6e428d7cb5e3b99fd695139fc7
- https://git.kernel.org/stable/c/1a6023edfbb5673f55fab6348f135fb3b1428ea5
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-99090 · CVE Program
- CVE-2026-99090 · NVD
- FIRST EPSS
- GHSA-3hrf-vpmj-gj4m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-99090 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences