CVE-2026-89812

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: force complete the MES ring fences on reset

The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is

skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses

a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1

reset, while fence_drv.sync_seq keeps advancing for every packet.

When the reset is triggered because MES itself stopped responding, the

timed-out packets advance sync_seq past the last hw fence value MES wrote.

After resume the first MES submission polls forever on a seq that is never

written back, failing the resume and wedging the box on a second reset:

amdgpu: MES ring buffer is full.

amdgpu: *ERROR* ring gfx_0.0.0 test failed (-110)

amdgpu: resume of IP block <gfx_v11_0> failed -110

amdgpu: GPU reset end with ret = -110

Force complete the MES scheduler ring fences together with the scheduler rings

so their hw fence is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References