{
  "public_date" : "2026-05-08T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify",
    "id" : "2468060",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2468060"
  },
  "cwe" : "CWE-821",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify\nInvalidating a dmabuf will impact other users of the shared BO.\nIn the scenario where process A moves the BO, it needs to inform\nprocess B about the move and process B will need to update its\npage table.\nThe commit fixes a synchronisation bug caused by the use of the\nticket: it made amdgpu_vm_handle_moved behave as if updating\nthe page table immediately was correct but in this case it's not.\nAn example is the following scenario, with 2 GPUs and glxgears\nrunning on GPU0 and Xorg running on GPU1, on a system where P2P\nPCI isn't supported:\nglxgears:\nexport linear buffer from GPU0 and import using GPU1\nsubmit frame rendering to GPU0\nsubmit tiled->linear blit\nXorg:\ncopy of linear buffer\nThe sequence of jobs would be:\ndrm_sched_job_run                       # GPU0, frame rendering\ndrm_sched_job_queue                     # GPU0, blit\ndrm_sched_job_done                      # GPU0, frame rendering\ndrm_sched_job_run                       # GPU0, blit\nmove linear buffer for GPU1 access      #\namdgpu_dma_buf_move_notify -> update pt # GPU0\nIt this point the blit job on GPU0 is still running and would\nlikely produce a page fault.", "A flaw was found in the Linux kernel's drm/amdgpu component. A synchronization bug in the amdgpu_dma_buf_move_notify function, which handles direct memory access buffer (dmabuf) movements, can lead to a page fault. This occurs when a process attempts to access a shared buffer while another process is still updating its page table after a buffer move, potentially causing a system crash or denial of service." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-43318\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43318\nhttps://lore.kernel.org/linux-cve-announce/2026050818-CVE-2026-43318-79ab@gregkh/T" ],
  "name" : "CVE-2026-43318",
  "csaw" : false
}