CVE-2026-31765

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB

Currently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while

KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with

4K pages, both values match (8KB), so allocation and reserved space

are consistent.

However, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,

while the reserved trap area remains 8KB. This mismatch causes the

kernel to crash when running rocminfo or rccl unit tests.

Kernel attempted to read user page (2) - exploit attempt? (uid: 1001)

BUG: Kernel NULL pointer dereference on read at 0x00000002

Faulting instruction address: 0xc0000000002c8a64

Oops: Kernel access of bad area, sig: 11 [#1]

LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries

CPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E

6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY

Tainted: [E]=UNSIGNED_MODULE

Hardware name: IBM,9105-42A POWER10 (ar

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References