---
cve: "CVE-2026-89812"
severity: "LOW"
cvss: 3.1
epss: "0.2%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-16 11:16:46"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T17:41:55+02:00"
---

# CVE-2026-89812

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: force complete the MES ring fences on reset

The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is
skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses
a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1
reset, while fence_drv.sync_seq keeps advancing for every packet.

When the reset is triggered because MES itself stopped responding, the
timed-out packets advance sync_seq past the last hw fence value MES wrote.
After resume the first MES submission polls forever on a seq that is never
written back, failing the resume and wedging the box on a second reset:

  amdgpu: MES ring buffer is full.
  amdgpu: *ERROR* ring gfx_0.0.0 test failed (-110)
  amdgpu: resume of IP block  failed -110
  amdgpu: GPU reset end with ret = -110

Force complete the MES scheduler ring fences together with the scheduler rings
so their hw fence is realigned to sync_seq.

v2: cover all XCCs (one scheduler ring each), not just mes.ring[0].

## Patch verfügbar (OSV)

- Kernel ≥ 7.2.5

## Referenzen

- <https://git.kernel.org/stable/c/ebe7542553d008e2285e0fbba0c63f0295a7e694>
- <https://git.kernel.org/stable/c/48dc279c3010ac8f91b1845b2abb3a1e9943a0f5>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89812) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_