Public bug reported:
The system freezes and then reboots (kernel.panic_on_oops=1, kdump captured the
crash).
This has happened twice since upgrading from linux-image 7.0.0-30 to 7.0.0-38
on 2026-10-18.
No such crashes were seen on 7.0.0-30.
Crash 1 — 2026-10-20 ~18:27, process: nautilus
BUG: unable to handle page fault for address: 0000000100000009
RIP: ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm]
amdgpu_vm_move_to_lru_tail <- amdgpu_cs_submit <- amdgpu_cs_ioctl
(an amdgpu MODE2 reset occurred earlier in the same boot)
Crash 2 — 2026-10-23 02:37, process: resources
02:17 list_add corruption in ttm_resource_move_to_lru_tail
(ttm_bo_populate <- ttm_bo_vm_fault_reserved <- amdgpu_gem_fault,
browser process)
and list_del corruption in ttm_resource_fini
02:36 the same list_add/list_del corruption from gnome-shell (amdgpu_cs_ioctl
-> amdgpu_cs_bo_validate)
02:37 Oops: general protection fault, probably for non-canonical address
0x6c5f326138666441
RIP: ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm]
amdgpu_vm_move_to_lru_tail <- amdgpu_cs_submit <- amdgpu_cs_ioctl
The corrupted list pointers contain ASCII data (kmalloc-96 objects), so this
looks like a
use-after-free of a ttm_resource on the LRU bulk-move list.
Hardware: ASUS VivoBook 16 M1603QA, AMD Ryzen 5000 (Cezanne) iGPU [1002:1638],
BIOS M1603QA.306
Software: Ubuntu 26.04, kernel 7.0.0-38.38 (7.0.14), Mesa 26.0.8,
linux-firmware 20260319, GNOME 50 Wayland
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-38-generic 7.0.0-38.38
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Fri Oct 23 02:57:39 2026
InstallationDate: Installed on 2026-10-18 (4 days ago)
InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64
(20260826)
MachineType: ASUSTeK COMPUTER INC. VivoBook_ASUSLaptop M1603QA_M1603QA
ProcEnviron:
LANG=ru_RU.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=eb48d0df-ed09-4279-80ac-a76b79d17c36 ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/21/2022
dmi.bios.release: 5.19
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: M1603QA.306
dmi.board.asset.tag: ATN12345678901234567
dmi.board.name: M1603QA
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: 1.0
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK COMPUTER INC.
dmi.chassis.version: 1.0
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrM1603QA.306:bd11/21/2022:br5.19:svnASUSTeKCOMPUTERINC.:pnVivoBook_ASUSLaptopM1603QA_M1603QA:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnM1603QA:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaVivobook:
dmi.product.family: Vivobook
dmi.product.name: VivoBook_ASUSLaptop M1603QA_M1603QA
dmi.product.version: 1.0
dmi.sys.vendor: ASUSTeK COMPUTER INC.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
** Attachment added: "kernel logs captured by kdump at the time of each crash."
https://bugs.launchpad.net/bugs/2171994/+attachment/6011798/+files/crash-dmesg-both.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171994
Title:
amdgpu/ttm: use-after-free in ttm_lru_bulk_move_tail causes GPF and
kernel panic on 7.0.0-38 (Cezanne)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171994/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
