In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping… (CVE-2026-98520)

The vulnerability in the Linux kernel's drm/amdkfd subsystem arises from kfd_dev_mapping caching the address_space of only the first /dev/kfd opener. When the first container exits, its inode is released, leaving kfd_dev_mapping with a dangling pointer. A subsequent GPU reset dereferences this freed inode, causing a hard hang due to an uninterruptible rwsem wait. Additionally, mappings from later openers reside in different address_spaces and are not unmapped during GPU reset, leaving stale doorbell and MMIO pages accessible to guest users without GPU backing, which risks PCIe transaction timeouts and NMI panics. The fix, adopted from DRM core, creates a private pseudo-filesystem and allocates a single anonymous inode at module initialization. All openers' file mappings are redirected to this inode's address_space, which lives as long as the amdgpu module, ensuring all VMAs are collected in one address_space and properly unmapped during GPU reset, eliminating dangling pointer risks and stale mappings.

The vulnerability can cause a system hang during GPU reset due to a use-after-free condition leading to an uninterruptible wait on a corrupted semaphore. It also allows stale memory mappings of doorbell and MMIO pages to remain accessible to guest users after GPU reset, potentially causing PCIe transaction timeouts and non-maskable interrupt (NMI) panics. These issues affect system stability and reliability in environments using SRIOV with multiple containers.

A fix has been implemented in the Linux kernel drm/amdkfd subsystem that addresses both the use-after-free and multi-container mapping gap issues by redirecting all openers' file mappings to a single anonymous inode's address_space owned by the module. Users should update to the kernel version containing this fix. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.