CVE-2026-80618

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free<br /> <br /> amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned DOORBELL and MMIO<br /> remap BOs (which are pinned at allocation time) before checking whether<br /> the BO is still mapped to the GPU. When the BO is still mapped, the<br /> function returns -EBUSY and leaves the BO alive, but it has already<br /> been unpinned. The BO is then unpinned again when it is finally freed<br /> during process teardown, triggering a ttm_bo_unpin() underflow warning:<br /> <br /> WARNING: CPU: 18 PID: 15066 at ttm/ttm_bo.c:650 amdttm_bo_unpin+0x6d/0x80 [amdttm]<br /> Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]<br /> RIP: 0010:amdttm_bo_unpin+0x6d/0x80 [amdttm]<br /> Call Trace:<br /> amdgpu_bo_unpin+0x1a/0x90 [amdgpu]<br /> amdgpu_amdkfd_gpuvm_unpin_bo+0x31/0xb0 [amdgpu]<br /> amdgpu_amdkfd_gpuvm_free_memory_of_gpu+0x3bf/0x460 [amdgpu]<br /> kfd_process_free_outstanding_kfd_bos+0xd4/0x170 [amdgpu]<br /> kfd_process_wq_release+0x109/0x1b0 [amdgpu]<br /> process_one_work+0x1e2/0x3b0<br /> worker_thread+0x50/0x3a0<br /> kthread+0xdd/0x100<br /> ret_from_fork+0x29/0x50<br /> <br /> Move the unpin after the mapped_to_gpu_memory check so it only happens<br /> once we are committed to freeing the BO.<br /> <br /> (cherry picked from commit 927c5b2defb9b09856444d94bebfd056a002bd75)