Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be… (CVE-2026-63879)

The Linux kernel vulnerability CVE-2026-63879 involves the drm/amdgpu driver where the notifier sequence in the amdgpu_hmm_range_get_pages function was read multiple times, potentially causing the system to work with invalid memory pages. This issue was corrected by modifying the code to read the notifier sequence only once and improving coding style. The vulnerability affects linux-hwe-edge kernel versions prior to various 7.0.0-xx releases for Ubuntu 24.04 LTS. The vendor advisory confirms a patch is available and recommends updating to fixed kernel package versions. The update requires a system reboot and recompilation of third-party kernel modules due to an ABI change.

If exploited, this vulnerability could cause the kernel to operate on invalid memory pages, potentially leading to system instability or privilege escalation. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild. The vulnerability is local with low attack complexity and requires low privileges but no user interaction.

A patch is available from the vendor. Users should apply the official kernel updates for linux-hwe-edge as provided in the Ubuntu security notices (e.g., USN-8593-1). After updating, a system reboot is required to activate the fixes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Standard system upgrades will handle this automatically unless kernel metapackages were manually removed.