CVE-2025-38520

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Don't call mmput from MMU notifier callback

If the process is exiting, the mmput inside mmu notifier callback from

compactd or fork or numa balancing could release the last reference

of mm struct to call exit_mmap and free_pgtable, this triggers deadlock

with below backtrace.

The deadlock will leak kfd process as mmu notifier release is not called

and cause VRAM leaking.

The fix is to take mm reference mmget_non_zero when adding prange to the

deferred list to pair with mmput in deferred list work.

If prange split and add into pchild list, the pchild work_item.mm is not

used, so remove the mm parameter from svm_range_unmap_split and

svm_range_add_child.

The backtrace of hung task:

INFO: task python:348105 blocked for more than 64512 seconds.

Call Trace:

__schedule+0x1c3/0x550

schedule+0x46/0xb0

rwsem_down_write_slowpath+0x24b/0x4c0

unlink_anon_vmas+0xb1/0x1c0

free_pgtables+0xa9/0x130

exi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References