CVE-2026-31462

Vulnerability

In the Linux kernel's AMDGPU DRM driver, a vulnerability exists in the handling of Process Address Space IDs (PASIDs). When a process exits and frees its PASID, it is possible that page faults are still pending in the interrupt handler (IH) ring buffer. If the same PASID is immediately reused by a new process, the new process may encounter hardware state left by the previous process, leading to interrupt issues [1].

Exploitation

The vulnerability can be triggered by a local attacker who can rapidly create and destroy processes that utilize the GPU via the amdgpu driver. The attack requires the ability to run code on the system and interact with the GPU hardware. No special privileges beyond local user access are needed, but the attacker must be able to cause PASID reuse before pending interrupts are drained.

Impact

A successful exploit could result in system instability or denial of service due to mishandled interrupts. The CVSS v3 score is 5.5 (Medium), indicating a moderate severity. There is no evidence of privilege escalation or data leakage from this vulnerability.

Mitigation

The fix changes the PASID allocator to use an IDR cyclic allocator, similar to kernel PID allocation, which prevents immediate reuse of PASIDs. This ensures that pending interrupts are cleared before a PASID is reassigned. The patch has been applied to the mainline kernel and backported to multiple stable kernel branches [1][2][3][4]. Users are advised to update their kernels to the latest patched versions.