CVE-2026-89827 drm/amdgpu: avoid force-completing uninitialized UVD rings

Not scored Published 16 Sep 2026 Updated 21 Oct 2026

A local attacker can cause a denial of service in the Linux kernel by triggering a null dereference in the AMD GPU driver when UVD rings are uninitialized.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-89827?

CVE-2026-89827 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid force-completing uninitialized UVD rings

uvd_v7_0_sw_init() does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpu_uvd_resume() unconditionally force-completes the decode ring when restoring its fence sequence.

Skip fence completion when the fence driver is not initialized.

Which versions are affected by CVE-2026-89827?

How do I fix CVE-2026-89827?

Apply the vendor's patch.

Is CVE-2026-89827 being exploited?

There is no known exploitation of CVE-2026-89827 in the wild and no public exploit code.

Sources

Also known as AZL-101303, BELL-CVE-2026-89827, DEBIAN-CVE-2026-89827, GHSA-9r9g-2xp7-pmx6, UBUNTU-CVE-2026-89827.