{"schema_version":"2","view":"grouped","data":[{"id":3421,"cve_ids":["CVE-2026-80728"],"payload":{"kind":"advisory","title":"Revert \"drm/amdgpu: fix aperture mapping leak\"","summary":"In the Linux kernel, the following vulnerability has been resolved: Revert \"drm/amdgpu: fix aperture mapping leak\" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback: BUG: unable to handle page fault ... PMD 0 RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu] Call Trace: amdgpu_device_fini_sw amdgpu_driver_release_kms devm_drm_dev_init_release devres_release_all This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a. (cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)","evidence":"cve:CVE-2026-80728","products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-80728","aliases":["CVE-2026-80728"],"metrics":[],"affected":[{"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","product":"Linux","versions":[{"status":"affected","version":"67bc3647e418e23dc0d17604bdba634a73de809f","lessThan":"7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a","versionType":"git"},{"status":"affected","version":"a343d028ad6c174da8dc6af560c51e6d140a6727","lessThan":"96d26143882f9cb47dcc1f3dd4e26d047e53ab9b","versionType":"git"},{"status":"affected","version":"6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa","lessThan":"a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d","versionType":"git"},{"status":"affected","version":"f5988b5c300a32ff751724ffd33d5a8d5873e4a7","lessThan":"496846a9411136eb9e86ad4f4e62d751bd1e1db5","versionType":"git"},{"status":"affected","version":"ea772a440d56b285f4d491affac50ecd41f6b402","lessThan":"b96c529cd2551b78316a4afa3237b2ed96ba03c8","versionType":"git"}],"programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"defaultStatus":"unaffected"},{"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","product":"Linux","versions":[{"status":"affected","version":"6.6.148","lessThan":"6.6.152","versionType":"semver"},{"status":"affected","version":"6.12.101","lessThan":"6.12.104","versionType":"semver"},{"status":"affected","version":"6.18.42","lessThan":"6.18.45","versionType":"semver"},{"status":"affected","version":"7.1.6","lessThan":"7.1.9","versionType":"semver"}],"programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"defaultStatus":"unaffected"}],"modified":"2026-09-29T12:08:20.287Z","provider":"cve","references":["https://git.kernel.org/stable/c/7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a","https://git.kernel.org/stable/c/96d26143882f9cb47dcc1f3dd4e26d047e53ab9b","https://git.kernel.org/stable/c/a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d","https://git.kernel.org/stable/c/496846a9411136eb9e86ad4f4e62d751bd1e1db5","https://git.kernel.org/stable/c/b96c529cd2551b78316a4afa3237b2ed96ba03c8"],"provider_metadata":{"cna":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-29T12:08:20.287Z"}}},"related_cves":[{"value":"CVE-2026-80728","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1686c74f-aee8-47ef-aac8-b35a00cfd8e1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80728","advisory_id":"1686c74f-aee8-47ef-aac8-b35a00cfd8e1","event_types":["advisory"],"published_at":"2026-10-24T21:35:34.631913+00:00","technologies":["core-cve","linux"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-03T08:21:47.126+00:00","detail_url":"/advisories/advisory%3A1686c74f-aee8-47ef-aac8-b35a00cfd8e1","group":{"id":"advisory:1686c74f-aee8-47ef-aac8-b35a00cfd8e1","revision":1,"primary_event_id":3439,"change":"published","superseded_by":[],"changed":{"id":3439,"cve_ids":["CVE-2026-80728"],"payload":{"kind":"advisory","title":"Revert \"drm/amdgpu: fix aperture mapping leak\"","summary":"In the Linux kernel, the following vulnerability has been resolved: Revert \"drm/amdgpu: fix aperture mapping leak\" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback: BUG: unable to handle page fault ... PMD 0 RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu] Call Trace: amdgpu_device_fini_sw amdgpu_driver_release_kms devm_drm_dev_init_release devres_release_all This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a. (cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)","evidence":"cve:CVE-2026-80728","products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-80728","aliases":["CVE-2026-80728"],"metrics":[],"affected":[{"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","product":"Linux","versions":[{"status":"affected","version":"67bc3647e418e23dc0d17604bdba634a73de809f","lessThan":"7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a","versionType":"git"},{"status":"affected","version":"a343d028ad6c174da8dc6af560c51e6d140a6727","lessThan":"96d26143882f9cb47dcc1f3dd4e26d047e53ab9b","versionType":"git"},{"status":"affected","version":"6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa","lessThan":"a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d","versionType":"git"},{"status":"affected","version":"f5988b5c300a32ff751724ffd33d5a8d5873e4a7","lessThan":"496846a9411136eb9e86ad4f4e62d751bd1e1db5","versionType":"git"},{"status":"affected","version":"ea772a440d56b285f4d491affac50ecd41f6b402","lessThan":"b96c529cd2551b78316a4afa3237b2ed96ba03c8","versionType":"git"}],"programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"defaultStatus":"unaffected"},{"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","product":"Linux","versions":[{"status":"affected","version":"6.6.148","lessThan":"6.6.152","versionType":"semver"},{"status":"affected","version":"6.12.101","lessThan":"6.12.104","versionType":"semver"},{"status":"affected","version":"6.18.42","lessThan":"6.18.45","versionType":"semver"},{"status":"affected","version":"7.1.6","lessThan":"7.1.9","versionType":"semver"}],"programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"defaultStatus":"unaffected"}],"modified":"2026-09-29T12:08:20.287Z","provider":"cve","references":["https://git.kernel.org/stable/c/7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a","https://git.kernel.org/stable/c/96d26143882f9cb47dcc1f3dd4e26d047e53ab9b","https://git.kernel.org/stable/c/a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d","https://git.kernel.org/stable/c/496846a9411136eb9e86ad4f4e62d751bd1e1db5","https://git.kernel.org/stable/c/b96c529cd2551b78316a4afa3237b2ed96ba03c8"],"provider_metadata":{"cna":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-29T12:08:20.287Z"}}},"related_cves":[{"value":"CVE-2026-80728","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1686c74f-aee8-47ef-aac8-b35a00cfd8e1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80728","advisory_id":"1686c74f-aee8-47ef-aac8-b35a00cfd8e1","event_types":["advisory"],"published_at":"2026-10-24T21:35:34.631913+00:00","technologies":["core-cve","linux"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-03T08:21:47.126+00:00","detail_url":"/events/3439"},"members":[{"id":3439,"cve_ids":["CVE-2026-80728"],"payload":{"kind":"advisory","title":"Revert \"drm/amdgpu: fix aperture mapping leak\"","summary":"In the Linux kernel, the following vulnerability has been resolved: Revert \"drm/amdgpu: fix aperture mapping leak\" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback: BUG: unable to handle page fault ... PMD 0 RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu] Call Trace: amdgpu_device_fini_sw amdgpu_driver_release_kms devm_drm_dev_init_release devres_release_all This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a. (cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)","evidence":"cve:CVE-2026-80728","products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-80728","aliases":["CVE-2026-80728"],"metrics":[],"affected":[{"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","product":"Linux","versions":[{"status":"affected","version":"67bc3647e418e23dc0d17604bdba634a73de809f","lessThan":"7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a","versionType":"git"},{"status":"affected","version":"a343d028ad6c174da8dc6af560c51e6d140a6727","lessThan":"96d26143882f9cb47dcc1f3dd4e26d047e53ab9b","versionType":"git"},{"status":"affected","version":"6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa","lessThan":"a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d","versionType":"git"},{"status":"affected","version":"f5988b5c300a32ff751724ffd33d5a8d5873e4a7","lessThan":"496846a9411136eb9e86ad4f4e62d751bd1e1db5","versionType":"git"},{"status":"affected","version":"ea772a440d56b285f4d491affac50ecd41f6b402","lessThan":"b96c529cd2551b78316a4afa3237b2ed96ba03c8","versionType":"git"}],"programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"defaultStatus":"unaffected"},{"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","product":"Linux","versions":[{"status":"affected","version":"6.6.148","lessThan":"6.6.152","versionType":"semver"},{"status":"affected","version":"6.12.101","lessThan":"6.12.104","versionType":"semver"},{"status":"affected","version":"6.18.42","lessThan":"6.18.45","versionType":"semver"},{"status":"affected","version":"7.1.6","lessThan":"7.1.9","versionType":"semver"}],"programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"],"defaultStatus":"unaffected"}],"modified":"2026-09-29T12:08:20.287Z","provider":"cve","references":["https://git.kernel.org/stable/c/7380f1bfe9d7ed3a4ca9d99a5c4df840fff9af2a","https://git.kernel.org/stable/c/96d26143882f9cb47dcc1f3dd4e26d047e53ab9b","https://git.kernel.org/stable/c/a2e326c52c4bcecc033cd3ca2733fdbe30fbf55d","https://git.kernel.org/stable/c/496846a9411136eb9e86ad4f4e62d751bd1e1db5","https://git.kernel.org/stable/c/b96c529cd2551b78316a4afa3237b2ed96ba03c8"],"provider_metadata":{"cna":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-29T12:08:20.287Z"}}},"related_cves":[{"value":"CVE-2026-80728","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1686c74f-aee8-47ef-aac8-b35a00cfd8e1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80728","advisory_id":"1686c74f-aee8-47ef-aac8-b35a00cfd8e1","event_types":["advisory"],"published_at":"2026-10-24T21:35:34.631913+00:00","technologies":["core-cve","linux"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-03T08:21:47.126+00:00","detail_url":"/events/3439"}]}}],"next_after":3421,"next_before":3421}