CVE-2026-53374 Details

A vulnerability in the Linux kernel's AMDGPU driver related to the Graphics Address Remapping Table (GART) has been addressed. The issue arose because the GART Translation Lookaside Buffer (TLB) is flushed after unmapping but not after mapping. The function 'amdgpu_bo_create_kernel()' failed to zero-initialize the buffer, leading to a situation where writing a single Page Table Entry (PTE) could cause the TLB to speculatively load other uninitialized entries from the same cache line. These garbage entries could be misinterpreted as valid, and a subsequent write to another PTE in the same cache line might result in the GPU using a stale, invalid PTE from the TLB. This vulnerability affects several versions of the Linux kernel.

The vulnerability has been fixed by modifying the GART table allocation function to include a step that zero-initializes the GART table with the appropriate flags immediately after allocation. This ensures that all entries are cleared before they can be used, preventing the TLB from loading any uninitialized data.