---
id: CVE-2026-45853
title: 'drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

  amdgpu_discovery_get_nps_info() internally allocates memory for ranges
  using kvcalloc(), whic…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f <
    16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e
  - >-
    Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f <
    9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5
  - >-
    Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f <
    f441538893eba6347b983f2904819ca6c99da65e
  - >-
    Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f <
    0c44d61945c4a80775292d96460aa2f22e62f86c
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:42:39.256391Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:43:00.207Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45853'
references:
  - url: 'https://git.kernel.org/stable/c/16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e'
  - url: 'https://git.kernel.org/stable/c/9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5'
  - url: 'https://git.kernel.org/stable/c/f441538893eba6347b983f2904819ca6c99da65e'
  - url: 'https://git.kernel.org/stable/c/0c44d61945c4a80775292d96460aa2f22e62f86c'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05647
ingestedAt: '2026-11-06T15:54:03.875Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

amdgpu_discovery_get_nps_info() internally allocates memory for ranges
using kvcalloc(), which may use vmalloc() for large allocation. Using
kfree() to release vmalloc memory will lead to a memory corruption.

Use kvfree() to safely handle both kmalloc and vmalloc allocations.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

## Affected

- `Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f < 16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e`
- `Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f < 9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5`
- `Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f < f441538893eba6347b983f2904819ca6c99da65e`
- `Linux >= b194d21b9bcc15b50df1bc3ff7428e51c2918a6f < 0c44d61945c4a80775292d96460aa2f22e62f86c`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.