---
id: CVE-2026-53374
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: zero-initialize GART table on allocation

  GART TLB is flushed after unmapping but not after mapping
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: zero-initialize GART table on allocation

  GART TLB is flushed after unmapping but not after mapping. Since
  amdgpu_bo_create_kernel() does not zero-initializ…
severity: high
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53374'
references:
  - url: 'https://git.kernel.org/stable/c/40df11255d71b02e20e70579f1b12b687e396e26'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/791941be5da125d9a1b228582bfdc300c05d05b3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8ae8b9e74bab94aab1d79f1688129bcc61c8b29a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/91fbb5e635c8fb1b49e15c19da06480089ef719f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b17175d0a375b3ed5e81597dac4983fdb46e478d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-07-19T15:31:16.149Z'
epss: 0.00127
epssPercentile: 0.02391
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    40df11255d71b02e20e70579f1b12b687e396e26
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    91fbb5e635c8fb1b49e15c19da06480089ef719f
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    8ae8b9e74bab94aab1d79f1688129bcc61c8b29a
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    b17175d0a375b3ed5e81597dac4983fdb46e478d
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    791941be5da125d9a1b228582bfdc300c05d05b3
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741
  - Linux 4.2
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:29:33.338896Z'
cvssSource: cna
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: zero-initialize GART table on allocation

GART TLB is flushed after unmapping but not after mapping. Since
amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a
single PTE is written the TLB may speculatively load other uninitialized
entries from the same cacheline. Those garbage entries can appear valid,
and a subsequent write to another PTE in the same cacheline may cause the
GPU to use a stale garbage PTE from the TLB.

Fix this by calling memset_io() to zero-initialize the GART table with
gart_pte_flags immediately after allocation.

Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work
since SDMA needs GART to be initialized to work.

(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.