VulnerabilityPublished 3 Sep 2026Updated 30 Oct 2026

CVE-2026-80728: Linux kernel · Revert "drm/amdgpu: fix aperture mapping leak

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in b96c529cd2551b78316a4afa3237b2ed96ba03c8 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:18 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in b96c529cd2551b78316a4afa3237b2ed96ba03c8, a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d, 496846a9411136eb9e86ad4f4e62d751bd1e1db5 +7

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.1.191 <6.2	Fixed in b96c529cd2551b78316a4afa3237b2ed96ba03c8 a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d 496846a9411136eb9e86ad4f4e62d751bd1e1db5 7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a 96d26143882f9cb47dcc1f3dd4e26d047e53ab9b 6.2
LinuxLinux	Affected >=7.1.6 <7.1.9	Fixed in 7.1.9
LinuxLinux	Affected >=6.18.42 <6.18.45	Fixed in 6.18.45
LinuxLinux	Affected >=6.12.101 <6.12.104	Fixed in 6.12.104
LinuxLinux	Affected >=6.6.148 <6.6.152	Fixed in 6.6.152

AI-suggested

A fix is available and has been applied by reverting the problematic commit. Users should update to the fixed Linux kernel versions 6.2, 6.6.152, 6.12.104, 6.18.45, or 7.1.9 or later to remediate this issue.

Description

A vulnerability in the Linux kernel related to the AMDGPU driver was resolved by reverting a previous commit that attempted to fix an aperture mapping leak. The issue involves improper resource teardown order causing a kernel page fault during device probe failure or rollback, potentially leading to system instability or crashes.

Impact

This vulnerability can cause kernel page faults during device probe failure or rollback in the AMDGPU driver, potentially leading to system crashes or instability. There is no indication of privilege escalation or remote code execution. No known exploits in the wild have been reported.

Summary

The vulnerability arises from the Linux kernel's device resource (devres) teardown order, which is last-in-first-out (LIFO). The aperture devres node was registered after the DRM device node, causing devres_release_all() to unmap the aperture before the DRM device release callback executes amdgpu_device_fini_sw(). This leads to IP software finalization callbacks (such as vcn_v4_0_sw_fini) accessing a pointer derived from an unmapped aperture base address, resulting in a kernel page fault. The issue was addressed by reverting the commit d871e99879cb5fd1fa798b006b4888887e63a17a that introduced the problematic fix.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:18 UTC

Technical details

References

Community reviews

Related threats