---
id: CVE-2026-89810
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

  If page migration from device to sys ram fails for some reasons driver needs
  release and unlock allocated system …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

  If page migration from device to sys ram fails for some reasons driver needs
  release and unlock allocated system …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    da87bcad1f781d822e7ced6d1de9dbc6d381c72e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a2035918a7a1d8fd3bb79d22e1e149294a5a8418
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    960c4a8069bfd352c48cc88592618f1ebe24c69e
  - Linux < 6.18.51
  - Linux < 7.2.5
  - Linux (all versions)
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T10:17:04.157'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89810'
references:
  - url: 'https://git.kernel.org/stable/c/960c4a8069bfd352c48cc88592618f1ebe24c69e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a2035918a7a1d8fd3bb79d22e1e149294a5a8418'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/da87bcad1f781d822e7ced6d1de9dbc6d381c72e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/44cad7ea3532f14999008d899daacc4ce4b633bf'
  - url: 'https://git.kernel.org/stable/c/872b7427e64f3e84b16c62577cbf3cd09a3401a2'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89810.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89810'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535321'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89810'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89810'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89810.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-89810'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
ingestedAt: '2026-09-16T10:53:54.005Z'
epss: 0.00175
epssPercentile: 0.06957
cwe:
  - CWE-416
scores:
  nvd: 7.8
  vendor: 4.7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

If page migration from device to sys ram fails for some reasons driver needs
release and unlock allocated system pages. To do that driver should use page
physical address, or pfn, then get struct page*. Current driver uses dma
address(for adev) that is not correct with IOMMU enabled, or even in general.

The patch releases and unlocks allocated system pages based on where migration
failed by struct page* of sys ram pages. Also dma_unmap correspodent system
ram pages at error path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89810.json)