Cloudanix VulnDB

CVE-2026-80919

None

CVSS

—

EPSS

0.2%

Published

Sep 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A locking mistake in AMD graphics drivers can cause computers to freeze or spam logs when graphics hardware encounters errors.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Recursive ww_mutex acquisition without ww_acquire_ctx in amdgpu_devcoredump_format when dumping IB contents after a GPU hang, causing lockdep warnings and potential self-deadlock on shared dma_resv objects between root PD and IB BOs.

Why it matters to the business

Kernel ring buffer flooding, system instability, and recovery failures on AMD GPU systems during error handling, raising maintenance costs and downtime risk for graphics workloads.

How an attack unfolds

A GPU job hang triggers the amdgpu_devcoredump_deferred_work workqueue, which calls amdgpu_devcoredump_format; the function acquires the VM root PD reservation then attempts amdgpu_bo_reserve on IB BOs, leading to recursive locking on the same mutex when objects share dma_resv.

How to fix it

Apply the upstream fix that moves IB dumping into a helper using a single drm_exec ticket with DRM_EXEC_IGNORE_DUPLICATES; rebuild and deploy the patched kernel across affected AMD GPU systems.

How to confirm the fix worked

Reproduce a GPU hang with amdgpu.gpu_recovery=0, inspect dmesg for absence of the reservation_ww_class_mutex recursive warning, and confirm the drm_exec locking path is present in the amdgpu module.

Typical attack path

  1. GPU command submission hangs
  2. Recovery timeout handler fires
  3. amdgpu_devcoredump_deferred_work executes
  4. amdgpu_vm_lock_by_pasid acquires first reservation
  5. amdgpu_bo_reserve attempts second reservation on shared object
  6. Recursive lock blocks or triggers warning

How to detect it

Search kernel logs and dmesg for 'reservation_ww_class_mutex' combined with 'amdgpu_devcoredump_format' and 'possible recursive locking detected'; correlate with amdgpu hang recovery workqueue entries.

What your security team should do

  • Prioritize kernel update on all AMD GPU hosts within standard patch windows
  • Enable GPU recovery logging to monitor hang frequency
  • Test core dump paths in staging environments before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB. Both reservations are reservation_ww_class_mutex objects and neither used a ww_acquire_ctx, which trips lockdep: WARNING: possible recursive locking detected -------------------------------------------- kworker/u128:0 is trying to acquire lock: ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] but task is already holding lock: ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] Possible unsafe locking scenario: CPU0 ---- lock(reservation_ww_class_mutex); lock(reservation_ww_class_mutex); *** DEADLOCK *** May be due to missing lock nesting notation Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu] Call Trace: __ww_mutex_lock.constprop.0 ww_mutex_lock amdgpu_bo_reserve amdgpu_devcoredump_format+0x1594 [amdgpu] amdgpu_devcoredump_deferred_work+0xea [amdgpu] The two reservations are on different BOs in the captured trace, so the splat is a lockdep-correctness warning, not an observed deadlock. It becomes a real self-deadlock whenever the IB BO shares its dma_resv with the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()): amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler refires every ~2 s and each invocation produces this splat, drowning the kernel ring buffer. Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB dumping into a separate helper that locks the root PD and every IB BO together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed by the same BO). Every lock is now a top-level acquire under one ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO refcount leak on the amdgpu_bo_reserve() failure path -- is removed. (cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)

Affected packages

Ecosystem Package Introduced Fixed