In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Don't call mmput from MMU notifier callback
If the process is exiting, the mmput inside mmu notifier callback from compactd or fork or numa balancing could release the last reference of mm struct to call exitmmap and freepgtable, this triggers deadlock with below backtrace.
The deadlock will leak kfd process as mmu notifier release is not called and cause VRAM leaking.
The fix is to take mm reference mmgetnonzero when adding prange to the deferred list to pair with mmput in deferred list work.
If prange split and add into pchild list, the pchild workitem.mm is not used, so remove the mm parameter from svmrangeunmapsplit and svmrangeadd_child.
The backtrace of hung task:
INFO: task python:348105 blocked for more than 64512 seconds. Call Trace: _schedule+0x1c3/0x550 schedule+0x46/0xb0 rwsemdownwriteslowpath+0x24b/0x4c0 unlinkanonvmas+0xb1/0x1c0 freepgtables+0xa9/0x130 exitmmap+0xbc/0x1a0 mmput+0x5a/0x140 svmrangecpuinvalidatepagetables+0x2b/0x40 [amdgpu] mnitreeinvalidate+0x72/0xc0 _mmunotifierinvalidaterangestart+0x48/0x60 trytounmapone+0x10fa/0x1400 rmapwalkanon+0x196/0x460 trytounmap+0xbb/0x210 migratepageunmap+0x54d/0x7e0 migratepagesbatch+0x1c3/0xae0 migratepagessync+0x98/0x240 migratepages+0x25c/0x520 compactzone+0x29d/0x590 compactzoneorder+0xb6/0xf0 trytocompactpages+0xbe/0x220 _allocpagesdirectcompact+0x96/0x1a0 _allocpagesslowpath+0x410/0x930 _allocpagesnodemask+0x3a9/0x3e0 dohugepmdanonymouspage+0xd7/0x3e0 _handlemmfault+0x5e3/0x5f0 handlemmfault+0xf7/0x2e0 hmmvmafault.isra.0+0x4d/0xa0 walkpmdrange.isra.0+0xa8/0x310 walkpudrange+0x167/0x240 walkpgdrange+0x55/0x100 _walkpagerange+0x87/0x90 walkpagerange+0xf6/0x160 hmmrangefault+0x4f/0x90 amdgpuhmmrangegetpages+0x123/0x230 [amdgpu] amdgputtmttgetuserpages+0xb1/0x150 [amdgpu] inituserpages+0xb1/0x2a0 [amdgpu] amdgpuamdkfdgpuvmallocmemoryofgpu+0x543/0x7d0 [amdgpu] kfdioctlallocmemoryofgpu+0x24c/0x4e0 [amdgpu] kfdioctl+0x29d/0x500 [amdgpu]
(cherry picked from commit a29e067bd38946f752b0ef855f3dfff87e77bec7)
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7eb0a25010a674c8fdfbece38353ef7be8c5834",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"113527788757177022556902919419099661752",
"171009889986640319557632916883903987591",
"74696574602637310756220430732789771689",
"261372724833175930702878494544699872174",
"236220316761648343331739741028963502039",
"170508912439859682689767789039623875572",
"85704843139182268905939317758030541934",
"63233581212187186027444863033021777245",
"270311521551412789640190469252699258270",
"123755764504527802268617223577965130990",
"190282427157519569551352930943875529641",
"200589132199700867218817072039178514725",
"30957219753433839695582148843482220790",
"327071920148878305701866920831194267893",
"91837231693635589646435082510481994559",
"213309809832256034815852852949522956010",
"55654145019281161293590764254965627269",
"172690535862590457832422815842036867972",
"235831099068812528465674110000834492019",
"190816333778823959239742171977846506857",
"136148134024962490524433545240026519973",
"254865160043867445310563612730127990587",
"179832717622146560215254653278048726501",
"67461938459955768711918670391547422380",
"307941897892952277497583793021959697463",
"114806953452723391106540647016065082973",
"65348381215722865065992802399876512559",
"124642566911803504235226831265179945595",
"21540436810202567545935861211186846995",
"193145064605576951297380910433353018612",
"59785468295387239903174065593420438306",
"33551931822241189536781122814537581491",
"8654025146173936320099455476624233052",
"313007528630079043208218591485430968895",
"129984987215783558181025397326050044544",
"7774970166889976751428226733785509674",
"89427353860989249225094347333850320700",
"86749645702604284078066166933323582525",
"208747239640292586408078645707020639544",
"23984181170017117429136365440176581705",
"19318193728693088159809387363926220512",
"294734985699871184763305231654670223019",
"81399613710724499555585796619274302119",
"283777512722560901134281910873045831479",
"17377779778398609980961982196624479078",
"155500377933282092604809471325941381524",
"132750558728152134112625631303638476521",
"330155401220131020097464324421004703750",
"312887591563177211823426288799383942690",
"243884255755658755828932307832219049243",
"96046804251131359654278937407862524300",
"191658901583150437874833902353811819588",
"293390888111248424136222883297202633119"
]
},
"signature_version": "v1",
"id": "CVE-2025-38520-03ca1133",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e90ee15ce28c61f6d83a0511c3e02e2662478350",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"113527788757177022556902919419099661752",
"171009889986640319557632916883903987591",
"74696574602637310756220430732789771689",
"261372724833175930702878494544699872174",
"236220316761648343331739741028963502039",
"170508912439859682689767789039623875572",
"85704843139182268905939317758030541934",
"63233581212187186027444863033021777245",
"270311521551412789640190469252699258270",
"123755764504527802268617223577965130990",
"190282427157519569551352930943875529641",
"200589132199700867218817072039178514725",
"30957219753433839695582148843482220790",
"327071920148878305701866920831194267893",
"91837231693635589646435082510481994559",
"213309809832256034815852852949522956010",
"55654145019281161293590764254965627269",
"172690535862590457832422815842036867972",
"235831099068812528465674110000834492019",
"190816333778823959239742171977846506857",
"136148134024962490524433545240026519973",
"254865160043867445310563612730127990587",
"179832717622146560215254653278048726501",
"67461938459955768711918670391547422380",
"307941897892952277497583793021959697463",
"114806953452723391106540647016065082973",
"65348381215722865065992802399876512559",
"124642566911803504235226831265179945595",
"21540436810202567545935861211186846995",
"193145064605576951297380910433353018612",
"59785468295387239903174065593420438306",
"33551931822241189536781122814537581491",
"8654025146173936320099455476624233052",
"313007528630079043208218591485430968895",
"129984987215783558181025397326050044544",
"7774970166889976751428226733785509674",
"89427353860989249225094347333850320700",
"86749645702604284078066166933323582525",
"208747239640292586408078645707020639544",
"23984181170017117429136365440176581705",
"19318193728693088159809387363926220512",
"294734985699871184763305231654670223019",
"81399613710724499555585796619274302119",
"283777512722560901134281910873045831479",
"17377779778398609980961982196624479078",
"155500377933282092604809471325941381524",
"132750558728152134112625631303638476521",
"330155401220131020097464324421004703750",
"312887591563177211823426288799383942690",
"243884255755658755828932307832219049243",
"96046804251131359654278937407862524300",
"191658901583150437874833902353811819588",
"293390888111248424136222883297202633119"
]
},
"signature_version": "v1",
"id": "CVE-2025-38520-058a16d8",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e90ee15ce28c61f6d83a0511c3e02e2662478350",
"deprecated": false,
"digest": {
"function_hash": "338026792413522077090585440186063809543",
"length": 782.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-0eaa6614",
"signature_type": "Function",
"target": {
"function": "svm_range_add_list_work",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7eb0a25010a674c8fdfbece38353ef7be8c5834",
"deprecated": false,
"digest": {
"function_hash": "227064831468595752639686136922840163345",
"length": 1043.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-18b4326f",
"signature_type": "Function",
"target": {
"function": "svm_range_cpu_invalidate_pagetables",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"function_hash": "227064831468595752639686136922840163345",
"length": 1043.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-1d9ea5f8",
"signature_type": "Function",
"target": {
"function": "svm_range_cpu_invalidate_pagetables",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"function_hash": "214862221517534226848933962675214256336",
"length": 1235.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-1e1f55e7",
"signature_type": "Function",
"target": {
"function": "svm_range_unmap_from_cpu",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7eb0a25010a674c8fdfbece38353ef7be8c5834",
"deprecated": false,
"digest": {
"function_hash": "338026792413522077090585440186063809543",
"length": 782.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-2b287d28",
"signature_type": "Function",
"target": {
"function": "svm_range_add_list_work",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e90ee15ce28c61f6d83a0511c3e02e2662478350",
"deprecated": false,
"digest": {
"function_hash": "127051465680650021537739141009457019240",
"length": 972.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-2d3dbde8",
"signature_type": "Function",
"target": {
"function": "svm_range_unmap_split",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"function_hash": "13431972004053844611864639211357067116",
"length": 1021.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-4230d4fd",
"signature_type": "Function",
"target": {
"function": "svm_range_split_by_granularity",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"function_hash": "338026792413522077090585440186063809543",
"length": 782.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-42a8531d",
"signature_type": "Function",
"target": {
"function": "svm_range_add_list_work",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"function_hash": "127051465680650021537739141009457019240",
"length": 972.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-5a64953b",
"signature_type": "Function",
"target": {
"function": "svm_range_unmap_split",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e90ee15ce28c61f6d83a0511c3e02e2662478350",
"deprecated": false,
"digest": {
"function_hash": "82593429223378335662836854424419554444",
"length": 2060.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-61413e1e",
"signature_type": "Function",
"target": {
"function": "svm_range_unmap_from_cpu",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7eb0a25010a674c8fdfbece38353ef7be8c5834",
"deprecated": false,
"digest": {
"function_hash": "319179033404593638438939268368509611362",
"length": 358.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-72438dbb",
"signature_type": "Function",
"target": {
"function": "svm_range_add_child",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"function_hash": "319179033404593638438939268368509611362",
"length": 358.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-a1d9cb5f",
"signature_type": "Function",
"target": {
"function": "svm_range_add_child",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e90ee15ce28c61f6d83a0511c3e02e2662478350",
"deprecated": false,
"digest": {
"function_hash": "319179033404593638438939268368509611362",
"length": 358.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-c8a4dd67",
"signature_type": "Function",
"target": {
"function": "svm_range_add_child",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e90ee15ce28c61f6d83a0511c3e02e2662478350",
"deprecated": false,
"digest": {
"function_hash": "227064831468595752639686136922840163345",
"length": 1043.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-eb333035",
"signature_type": "Function",
"target": {
"function": "svm_range_cpu_invalidate_pagetables",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7eb0a25010a674c8fdfbece38353ef7be8c5834",
"deprecated": false,
"digest": {
"function_hash": "82593429223378335662836854424419554444",
"length": 2060.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-eb5d2128",
"signature_type": "Function",
"target": {
"function": "svm_range_unmap_from_cpu",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7eb0a25010a674c8fdfbece38353ef7be8c5834",
"deprecated": false,
"digest": {
"function_hash": "127051465680650021537739141009457019240",
"length": 972.0
},
"signature_version": "v1",
"id": "CVE-2025-38520-f8289e59",
"signature_type": "Function",
"target": {
"function": "svm_range_unmap_split",
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@145a56bd68f4bff098d59fbc7c263d20dfef4fc4",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"113527788757177022556902919419099661752",
"171009889986640319557632916883903987591",
"74696574602637310756220430732789771689",
"261372724833175930702878494544699872174",
"236220316761648343331739741028963502039",
"170508912439859682689767789039623875572",
"85704843139182268905939317758030541934",
"63233581212187186027444863033021777245",
"270311521551412789640190469252699258270",
"199104390106514602179616481344699092801",
"115222954859639635022375754394376403928",
"289328521049188783659969803193602018178",
"106667227938009405347892407453446406532",
"159611238747600878762228016315111750213",
"125665589655041354476618202955304415178",
"88733216949830288318946026077370317188",
"21079660734236368228837016250157453308",
"100033280834022449120286521920023023480",
"218836371660867483188701872277123229292",
"123755764504527802268617223577965130990",
"190282427157519569551352930943875529641",
"200589132199700867218817072039178514725",
"30957219753433839695582148843482220790",
"327071920148878305701866920831194267893",
"91837231693635589646435082510481994559",
"213309809832256034815852852949522956010",
"55654145019281161293590764254965627269",
"172690535862590457832422815842036867972",
"235831099068812528465674110000834492019",
"190816333778823959239742171977846506857",
"136148134024962490524433545240026519973",
"254865160043867445310563612730127990587",
"179832717622146560215254653278048726501",
"67461938459955768711918670391547422380",
"307941897892952277497583793021959697463",
"114806953452723391106540647016065082973",
"65348381215722865065992802399876512559",
"124642566911803504235226831265179945595",
"21540436810202567545935861211186846995",
"193145064605576951297380910433353018612",
"59785468295387239903174065593420438306",
"33551931822241189536781122814537581491",
"8654025146173936320099455476624233052",
"313007528630079043208218591485430968895",
"129984987215783558181025397326050044544",
"7774970166889976751428226733785509674",
"89427353860989249225094347333850320700",
"86749645702604284078066166933323582525",
"208747239640292586408078645707020639544",
"23984181170017117429136365440176581705",
"19318193728693088159809387363926220512",
"294734985699871184763305231654670223019",
"81399613710724499555585796619274302119",
"283777512722560901134281910873045831479",
"17377779778398609980961982196624479078",
"155500377933282092604809471325941381524",
"132750558728152134112625631303638476521",
"330155401220131020097464324421004703750",
"312887591563177211823426288799383942690",
"243884255755658755828932307832219049243",
"96046804251131359654278937407862524300",
"191658901583150437874833902353811819588",
"293390888111248424136222883297202633119"
]
},
"signature_version": "v1",
"id": "CVE-2025-38520-fb95d8a4",
"signature_type": "Line",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
}
}
]