---
id: CVE-2026-46220
title: 'drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

  sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
  that verify fence writeback addr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    ecaa80318e900ca0c3f687742ede33b41cfd2f8e
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    25e7d56a39657d56d1ea6d78992f7ed15dedb412
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    d4c56932d29773e278be6a65a5384a36c95b89a4
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    4f7ca00fa91daf0795ec6b3b130c5ebba1f155fe
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    d331fb241a4602253976ddd65144a8ba2b05665d
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    0b91ea46bb68abf98a082bf239092253bbd6aaa2
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    a4fd82fb0757c180bf622907397c528b89a827b2
  - >-
    Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 <
    78d2e624fa073c14970aa097adcf3ea31c157a66
  - Linux 4.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:12:22.194845Z'
published: '2026-05-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:45.342Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46220'
references:
  - url: 'https://git.kernel.org/stable/c/ecaa80318e900ca0c3f687742ede33b41cfd2f8e'
  - url: 'https://git.kernel.org/stable/c/25e7d56a39657d56d1ea6d78992f7ed15dedb412'
  - url: 'https://git.kernel.org/stable/c/d4c56932d29773e278be6a65a5384a36c95b89a4'
  - url: 'https://git.kernel.org/stable/c/4f7ca00fa91daf0795ec6b3b130c5ebba1f155fe'
  - url: 'https://git.kernel.org/stable/c/d331fb241a4602253976ddd65144a8ba2b05665d'
  - url: 'https://git.kernel.org/stable/c/0b91ea46bb68abf98a082bf239092253bbd6aaa2'
  - url: 'https://git.kernel.org/stable/c/a4fd82fb0757c180bf622907397c528b89a827b2'
  - url: 'https://git.kernel.org/stable/c/78d2e624fa073c14970aa097adcf3ea31c157a66'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01779
ingestedAt: '2026-11-06T16:57:43.322Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
that verify fence writeback addresses are dword-aligned.  These
assertions can be reached from unprivileged userspace via crafted
DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a
scheduler worker thread.

Replace both BUG_ON() calls with WARN_ON() to log the condition without
crashing the kernel.  A misaligned fence address at this point indicates
a driver bug, but crashing the kernel is never the correct response when
the assertion is reachable from userspace.

The CS IOCTL path is the correct place to filter invalid submissions;
the ring emission callback is too late to do anything about it.

(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)

## Affected

- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < ecaa80318e900ca0c3f687742ede33b41cfd2f8e`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 25e7d56a39657d56d1ea6d78992f7ed15dedb412`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < d4c56932d29773e278be6a65a5384a36c95b89a4`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 4f7ca00fa91daf0795ec6b3b130c5ebba1f155fe`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < d331fb241a4602253976ddd65144a8ba2b05665d`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 0b91ea46bb68abf98a082bf239092253bbd6aaa2`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < a4fd82fb0757c180bf622907397c528b89a827b2`
- `Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 78d2e624fa073c14970aa097adcf3ea31c157a66`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.