GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43318 (GCVE-0-2026-43318)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:26 – Updated: 2026-05-11 22:22
VLAI
Title
drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify Invalidating a dmabuf will impact other users of the shared BO. In the scenario where process A moves the BO, it needs to inform process B about the move and process B will need to update its page table. The commit fixes a synchronisation bug caused by the use of the ticket: it made amdgpu_vm_handle_moved behave as if updating the page table immediately was correct but in this case it's not. An example is the following scenario, with 2 GPUs and glxgears running on GPU0 and Xorg running on GPU1, on a system where P2P PCI isn't supported: glxgears: export linear buffer from GPU0 and import using GPU1 submit frame rendering to GPU0 submit tiled->linear blit Xorg: copy of linear buffer The sequence of jobs would be: drm_sched_job_run # GPU0, frame rendering drm_sched_job_queue # GPU0, blit drm_sched_job_done # GPU0, frame rendering drm_sched_job_run # GPU0, blit move linear buffer for GPU1 access # amdgpu_dma_buf_move_notify -> update pt # GPU0 It this point the blit job on GPU0 is still running and would likely produce a page fault.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a448cb003edcb4b63d0a9c95f3faab724e6150fb , < 82a7ea35a1526bef8ae170c33ff80e5db7728961 (git)
Affected: a448cb003edcb4b63d0a9c95f3faab724e6150fb , < 89a9389ad70d3c69538e59d87df67d407aef4c26 (git)
Affected: a448cb003edcb4b63d0a9c95f3faab724e6150fb , < 3307459eb3583115264421e859858d1f90f3694a (git)
Affected: a448cb003edcb4b63d0a9c95f3faab724e6150fb , < b18fc0ab837381c1a6ef28386602cd888f2d9edf (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82a7ea35a1526bef8ae170c33ff80e5db7728961",
              "status": "affected",
              "version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
              "versionType": "git"
            },
            {
              "lessThan": "89a9389ad70d3c69538e59d87df67d407aef4c26",
              "status": "affected",
              "version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
              "versionType": "git"
            },
            {
              "lessThan": "3307459eb3583115264421e859858d1f90f3694a",
              "status": "affected",
              "version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
              "versionType": "git"
            },
            {
              "lessThan": "b18fc0ab837381c1a6ef28386602cd888f2d9edf",
              "status": "affected",
              "version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify\n\nInvalidating a dmabuf will impact other users of the shared BO.\nIn the scenario where process A moves the BO, it needs to inform\nprocess B about the move and process B will need to update its\npage table.\n\nThe commit fixes a synchronisation bug caused by the use of the\nticket: it made amdgpu_vm_handle_moved behave as if updating\nthe page table immediately was correct but in this case it\u0027s not.\n\nAn example is the following scenario, with 2 GPUs and glxgears\nrunning on GPU0 and Xorg running on GPU1, on a system where P2P\nPCI isn\u0027t supported:\n\nglxgears:\n  export linear buffer from GPU0 and import using GPU1\n  submit frame rendering to GPU0\n  submit tiled-\u003elinear blit\nXorg:\n  copy of linear buffer\n\nThe sequence of jobs would be:\n  drm_sched_job_run                       # GPU0, frame rendering\n  drm_sched_job_queue                     # GPU0, blit\n  drm_sched_job_done                      # GPU0, frame rendering\n  drm_sched_job_run                       # GPU0, blit\n  move linear buffer for GPU1 access      #\n  amdgpu_dma_buf_move_notify -\u003e update pt # GPU0\n\nIt this point the blit job on GPU0 is still running and would\nlikely produce a page fault."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:22:14.662Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82a7ea35a1526bef8ae170c33ff80e5db7728961"
        },
        {
          "url": "https://git.kernel.org/stable/c/89a9389ad70d3c69538e59d87df67d407aef4c26"
        },
        {
          "url": "https://git.kernel.org/stable/c/3307459eb3583115264421e859858d1f90f3694a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"
        }
      ],
      "title": "drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43318",
    "datePublished": "2026-05-08T13:26:13.557Z",
    "dateReserved": "2026-05-01T14:12:56.001Z",
    "dateUpdated": "2026-05-11T22:22:14.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43318",
      "date": "2026-09-16",
      "epss": "0.00122",
      "percentile": "0.02279"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:49:12.000Z",
      "cve": "CVE-2026-43318",
      "id": "msrc_CVE-2026-43318",
      "initial_release_date": "2026-05-09T01:01:34.000Z",
      "product_status:known_affected": "7",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43318.json",
      "version": "10"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43318\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T14:16:40.363\",\"lastModified\":\"2026-06-17T10:49:22.363\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify\\n\\nInvalidating a dmabuf will impact other users of the shared BO.\\nIn the scenario where process A moves the BO, it needs to inform\\nprocess B about the move and process B will need to update its\\npage table.\\n\\nThe commit fixes a synchronisation bug caused by the use of the\\nticket: it made amdgpu_vm_handle_moved behave as if updating\\nthe page table immediately was correct but in this case it\u0027s not.\\n\\nAn example is the following scenario, with 2 GPUs and glxgears\\nrunning on GPU0 and Xorg running on GPU1, on a system where P2P\\nPCI isn\u0027t supported:\\n\\nglxgears:\\n  export linear buffer from GPU0 and import using GPU1\\n  submit frame rendering to GPU0\\n  submit tiled-\u003elinear blit\\nXorg:\\n  copy of linear buffer\\n\\nThe sequence of jobs would be:\\n  drm_sched_job_run                       # GPU0, frame rendering\\n  drm_sched_job_queue                     # GPU0, blit\\n  drm_sched_job_done                      # GPU0, frame rendering\\n  drm_sched_job_run                       # GPU0, blit\\n  move linear buffer for GPU1 access      #\\n  amdgpu_dma_buf_move_notify -\u003e update pt # GPU0\\n\\nIt this point the blit job on GPU0 is still running and would\\nlikely produce a page fault.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a448cb003edcb4b63d0a9c95f3faab724e6150fb\",\"lessThan\":\"82a7ea35a1526bef8ae170c33ff80e5db7728961\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a448cb003edcb4b63d0a9c95f3faab724e6150fb\",\"lessThan\":\"89a9389ad70d3c69538e59d87df67d407aef4c26\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a448cb003edcb4b63d0a9c95f3faab724e6150fb\",\"lessThan\":\"3307459eb3583115264421e859858d1f90f3694a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a448cb003edcb4b63d0a9c95f3faab724e6150fb\",\"lessThan\":\"b18fc0ab837381c1a6ef28386602cd888f2d9edf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"3E952027-3F78-4493-B648-5D99B5D396A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3307459eb3583115264421e859858d1f90f3694a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82a7ea35a1526bef8ae170c33ff80e5db7728961\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89a9389ad70d3c69538e59d87df67d407aef4c26\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-01T16:43:28+00:00",
      "cve": "CVE-2026-43318",
      "id": "CVE-2026-43318",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43318.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T17:06:03Z",
      "cve": "CVE-2026-43318",
      "id": "CVE-2026-43318",
      "initial_release_date": "2026-05-13T03:35:28Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "554",
      "product_status:known_not_affected": "164",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43318",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43318.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.