{"id":"CVE-2026-31765","title":"drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB\n\nCurrently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while\nKFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 34a1de0f79352086884553f78db271f957a98583 < 6b2614a0ff05a2d2836311425091c8feca6f0c21","Linux >= 34a1de0f79352086884553f78db271f957a98583 < 77c918eaa4c916751769242567407f61c6af142a","Linux >= 34a1de0f79352086884553f78db271f957a98583 < d3508cf822c4d96d3e492210314f8f6f2da7df58","Linux >= 34a1de0f79352086884553f78db271f957a98583 < 4487571ef17a30d274600b3bd6965f497a881299","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:24:59.201145Z"},"published":"2026-05-01","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:24.368Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31765","references":[{"url":"https://git.kernel.org/stable/c/6b2614a0ff05a2d2836311425091c8feca6f0c21"},{"url":"https://git.kernel.org/stable/c/77c918eaa4c916751769242567407f61c6af142a"},{"url":"https://git.kernel.org/stable/c/d3508cf822c4d96d3e492210314f8f6f2da7df58"},{"url":"https://git.kernel.org/stable/c/4487571ef17a30d274600b3bd6965f497a881299"}],"tags":["cve.org"],"epss":0.00122,"epssPercentile":0.01987,"ingestedAt":"2026-11-06T15:54:04.042Z","slug":"CVE-2026-31765","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB\n\nCurrently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while\nKFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with\n4K pages, both values match (8KB), so allocation and reserved space\nare consistent.\n\nHowever, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,\nwhile the reserved trap area remains 8KB. This mismatch causes the\nkernel to crash when running rocminfo or rccl unit tests.\n\nKernel attempted to read user page (2) - exploit attempt? (uid: 1001)\nBUG: Kernel NULL pointer dereference on read at 0x00000002\nFaulting instruction address: 0xc0000000002c8a64\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\nCPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E\n6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY\nTainted: [E]=UNSIGNED_MODULE\nHardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006\nof:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries\nNIP:  c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730\nREGS: c0000001e0957580 TRAP: 0300 Tainted: G E\nMSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268\nXER: 00000036\nCFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000\nIRQMASK: 1\nGPR00: c00000000125d908 c0000001e0957820 c0000000016e8100\nc00000013d814540\nGPR04: 0000000000000002 c00000013d814550 0000000000000045\n0000000000000000\nGPR08: c00000013444d000 c00000013d814538 c00000013d814538\n0000000084002268\nGPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff\n0000000000020000\nGPR16: 0000000000000000 0000000000000002 c00000015f653000\n0000000000000000\nGPR20: c000000138662400 c00000013d814540 0000000000000000\nc00000013d814500\nGPR24: 0000000000000000 0000000000000002 c0000001e0957888\nc0000001e0957878\nGPR28: c00000013d814548 0000000000000000 c00000013d814540\nc0000001e0957888\nNIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0\nLR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00\nCall Trace:\n0xc0000001e0957890 (unreliable)\n__mutex_lock.constprop.0+0x58/0xd00\namdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]\nkfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]\nkfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]\nkfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]\nkfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]\nkfd_ioctl+0x514/0x670 [amdgpu]\nsys_ioctl+0x134/0x180\nsystem_call_exception+0x114/0x300\nsystem_call_vectored_common+0x15c/0x2ec\n\nThis patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and\nKFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve\n64 KB for the trap in the address space, but only allocate 8 KB within\nit. With this approach, the allocation size never exceeds the reserved\narea.\n\n(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)\n\n## Affected\n\n- `Linux >= 34a1de0f79352086884553f78db271f957a98583 < 6b2614a0ff05a2d2836311425091c8feca6f0c21`\n- `Linux >= 34a1de0f79352086884553f78db271f957a98583 < 77c918eaa4c916751769242567407f61c6af142a`\n- `Linux >= 34a1de0f79352086884553f78db271f957a98583 < d3508cf822c4d96d3e492210314f8f6f2da7df58`\n- `Linux >= 34a1de0f79352086884553f78db271f957a98583 < 4487571ef17a30d274600b3bd6965f497a881299`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}