CVE Intelligence
Unknown

CVE-2026-80919 — drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB. Both reservations are reservation_ww_class_mutex objects and neither used a ww_acquire_ctx, which trips lockdep: WARNING: possible recursive locking detected -------------------------------------------- kworker/u128:0 is trying to acquire lock: ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] but task is already holding lock: ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu] Possible unsafe locking scenario: CPU0 ---- lock(reservation_ww_class_mutex); lock(reservation_ww_class_mutex); *** DEADLOCK *** May be due to missing lock nesting notation Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu] Call Trace: __ww_mutex_lock.constprop.0 ww_mutex_lock amdgpu_bo_reserve amdgpu_devcoredump_format+0x1594 [amdgpu] amdgpu_devcoredump_deferred_work+0xea [amdgpu] The two reservations are on different BOs in the captured trace, so the splat is a lockdep-correctness warning, not an observed deadlock. It becomes a real self-deadlock whenever the IB BO shares its dma_resv with the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()): amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler refires every ~2 s and each invocation produces this splat, drowning the kernel ring buffer. Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB dumping into a separate helper that locks the root PD and every IB BO together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed by the same BO). Every lock is now a top-level acquire under one ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO refcount leak on the amdgpu_bo_reserve() failure path -- is removed. (cherry picked from commit d6bf4242731219ee08ce54c365631e395486651e)

Published Sep 9, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • EPSS 0.2% (30-day exploitation probability)+1

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
0.2%
ahead of 9% of scored CVEs · Oct 27, 2026
Affects
Linux
Linux
CVSS base
—
Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
  2. No fix documented in the sources: reduce exposure and monitor the vendor advisory.
  3. Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Linux Linux ≥ 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 and < 4e9b4dee0777ec9c835a4746e2d30382dd9d1044≥ 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 and < 7152b248dc3c8d5fa8629e99ed5655dd41b51562version 7.1 Vulnerable CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 27, 2026 · 12 reading(s) · max 0.20%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Not enough vector or weakness data: use the affected application’s logs as a starting point.
application logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Record published
    Oct 15, 2026
  • Affected products added · linux/linux
    Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
  • Source status changed · → Received
    Oct 15, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 15, 2026 · NIST National Vulnerability Database
  • CVE published
    Sep 9, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

  • 1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

2 on the record

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

  • CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 5h
  • CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 5h
  • CVE-2026-99214 drm/vc4: hdmi: Move packet RAM enable to PM runtime 5h
  • CVE-2026-99213 vsock: treat TCP_CLOSING as once-established 5h
  • CVE-2026-99212 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure 5h
  • CVE-2026-99211 netlink: reset skb headers before unicast and multicast filtering 5h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No CVSS score published by NVD, the CNA, CISA or GitHub so far.
  • No fixed version, patch or mitigation documented.
  • No CISA SSVC assessment.
  • No CWE classification.
  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-80919 is "drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.20% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.