Priority Inversion Vulnerability in Linux Kernel's AMDGPU Package
Summary
CVE-2025-38104: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV RLCG Register Access is a way for virtual function... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. The AMDGPU package is a driver for AMD graphics cards, enabling the use of GPU features in a virtualized environment. This package is crucial for performance in graphics rendering and computation tasks. However, it is susceptible to a priority inversion vulnerability that can lead to race conditions during register access.
Vulnerability Detail
In the Linux kernel, specifically within the AMDGPU driver, a vulnerability has been identified that arises from the use of mutexes for accessing RLCG registers. When multiple threads or virtual functions (VFs) attempt to access the same registers simultaneously, it can lead to race conditions. The issue is exacerbated when a low-priority task holds a mutex that a high-priority task needs, resulting in priority inversion. This can cause system instability and degraded performance, particularly in high-demand environments.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the RLCG register access in scenarios where multiple threads may contend for access. This may involve modifying application logic to serialize access to these registers manually.
Conclusion
The CVE-2025-38104 vulnerability in the Linux kernel's AMDGPU driver poses a significant risk due to potential priority inversion and race conditions. Users are encouraged to update their systems to mitigate this risk and ensure stable performance. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38104 is a vulnerability in the Linux kernel's AMDGPU driver that can lead to priority inversion and race conditions during register access.
The vulnerability can cause system instability and degraded performance, especially in environments where multiple threads are accessing GPU registers simultaneously.
The vulnerability affects systems running the Linux kernel with the AMDGPU driver, particularly Debian versions 12 and 13.
Yes, users are advised to update their Linux packages to the latest version that includes the fix for this vulnerability.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities without requiring installation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
