---
id: CVE-2026-43318
title: 'drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify

  Invalidating a dmabuf will impact other users of the shared BO.
  In the scenario where process A moves the B…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb <
    82a7ea35a1526bef8ae170c33ff80e5db7728961
  - >-
    Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb <
    89a9389ad70d3c69538e59d87df67d407aef4c26
  - >-
    Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb <
    3307459eb3583115264421e859858d1f90f3694a
  - >-
    Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb <
    b18fc0ab837381c1a6ef28386602cd888f2d9edf
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:35:29.359286Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:48.510Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43318'
references:
  - url: 'https://git.kernel.org/stable/c/82a7ea35a1526bef8ae170c33ff80e5db7728961'
  - url: 'https://git.kernel.org/stable/c/89a9389ad70d3c69538e59d87df67d407aef4c26'
  - url: 'https://git.kernel.org/stable/c/3307459eb3583115264421e859858d1f90f3694a'
  - url: 'https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01979
ingestedAt: '2026-11-06T15:54:03.938Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify

Invalidating a dmabuf will impact other users of the shared BO.
In the scenario where process A moves the BO, it needs to inform
process B about the move and process B will need to update its
page table.

The commit fixes a synchronisation bug caused by the use of the
ticket: it made amdgpu_vm_handle_moved behave as if updating
the page table immediately was correct but in this case it's not.

An example is the following scenario, with 2 GPUs and glxgears
running on GPU0 and Xorg running on GPU1, on a system where P2P
PCI isn't supported:

glxgears:
  export linear buffer from GPU0 and import using GPU1
  submit frame rendering to GPU0
  submit tiled->linear blit
Xorg:
  copy of linear buffer

The sequence of jobs would be:
  drm_sched_job_run                       # GPU0, frame rendering
  drm_sched_job_queue                     # GPU0, blit
  drm_sched_job_done                      # GPU0, frame rendering
  drm_sched_job_run                       # GPU0, blit
  move linear buffer for GPU1 access      #
  amdgpu_dma_buf_move_notify -> update pt # GPU0

It this point the blit job on GPU0 is still running and would
likely produce a page fault.

## Affected

- `Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb < 82a7ea35a1526bef8ae170c33ff80e5db7728961`
- `Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb < 89a9389ad70d3c69538e59d87df67d407aef4c26`
- `Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb < 3307459eb3583115264421e859858d1f90f3694a`
- `Linux >= a448cb003edcb4b63d0a9c95f3faab724e6150fb < b18fc0ab837381c1a6ef28386602cd888f2d9edf`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.