AMD graphics hardware on Linux just got a small but critical patch that stops a timing bug from crashing your desktop or compute workloads. On April 22, 2026, the National Vulnerability Database published CVE-2026-31462, a flaw in the AMDGPU kernel driver that allowed a newly launched process to inherit stale hardware state from an old one—leading to GPU hangs, intermittent faults, and system instability. The fix? A one-line change that makes the driver hand out process address space IDs in a less predictable order.

The patch is already in upstream Linux kernels and working its way into stable and distribution updates. For Windows users with AMD Radeon hardware, the story is quieter: AMD has not announced a parallel CVE, but the underlying race condition lives in the silicon, not the operating system. If you have been battling random GPU freezes under heavy workloads, this patch is a reminder that your next driver update may contain a similar invisible improvement.

A Tiny Bug with Big Consequences

The vulnerability resides in how the AMDGPU driver recycles Process Address Space IDs (PASIDs)—identifiers that let the GPU and IOMMU separate memory transactions from different applications. When a GPU-accelerated application exits, the driver frees its PASID. If a new process grabs that same PASID immediately, it can inherit interrupt-handling leftovers from the previous owner. Stale page-fault notifications in the hardware’s ring buffer may get misattributed, leaving the GPU confused about which process owns which memory context.

That confusion rarely triggers a classic crash. Instead, it produces symptoms that mimic garden-variety driver bugs: a game freezes for half a second, a compute job fails with an opaque error code, a machine running rapid container churn suddenly needs a reboot. The instability is real, but it is devilishly hard to reproduce on demand, which is why this bug likely lurked in the driver for years.

Linux kernel maintainers fixed the problem in commit 8f1de51f49be, switching from an allocator that always picks the lowest available PASID to a cyclic IDR allocator—the same approach used for process IDs. Instead of handing out the just-freed number, the driver now walks forward through a table of identifiers, significantly reducing the chance that a new process collides with in-flight hardware activity from the old one.

PASID: The ID Tag That Keeps Your GPU Sane

To understand why this matters, imagine a busy airport baggage system where each suitcase gets a barcode. If you tear off a barcode and stick it on a new bag while the old bag is still moving through the tunnels, the conveyor belt may deliver the new luggage to the wrong carousel. In the AMDGPU world, PASIDs are those barcodes. They tag every GPU memory access so the IOMMU can route page faults and translation requests back to the correct application.

Modern GPUs handle thousands of such events in flight. When an application quits, the driver cannot instantly cancel every pending interrupt; the hardware may have already queued a fault notification that will arrive microseconds later. Reusing the PASID too quickly creates a brief window where the driver sees a fault for the old process and tries to recover using state from the new one—a recipe for corrupted GPU command buffers or hung execution units.

The cyclic allocator does not close the window entirely. It just makes it far less likely for the same number to reappear within the critical few milliseconds. It is a simple fix, but exactly the sort that production environments need: low-risk, easy to backport, and unlikely to introduce regressions.

Should Windows Users Worry?

CVE-2026-31462 is formally a Linux kernel vulnerability, and the Microsoft Security Response Center (MSRC) advisory linked in the disclosure confirms it does not affect Windows natively. However, the silicon-level behavior that enables the race exists on every modern AMD GPU, regardless of operating system. AMD’s Windows Driver Model (WDDM) driver manages PASIDs differently—using a hardware scheduler that may be less prone to immediate reuse—but the company has a history of shipping reliability fixes that mirror Linux kernel discoveries.

If you run an AMD Radeon graphics card under Windows, you should:

  • Check the release notes for your next Adrenalin driver update for any mention of “intermittent stability improvements” or “GPU hang fixes during process termination.”
  • Be skeptical of unexplained GPU crashes that happen when you rapidly open and close GPU-accelerated applications (browser tabs, image editors, machine-learning shells).
  • Report persistent instability through AMD’s bug reporting tool, noting whether the issue correlates with process churn.

For power users who dual-boot or run Windows Subsystem for Linux (WSL) with GPU acceleration, the Linux kernel patch is directly relevant. WSL2 uses a real Linux kernel, and Microsoft backports security fixes into its WSL kernel regularly. A future WSL update will likely absorb the cyclic PASID allocator patch, protecting GPU workloads inside Linux distributions.

How We Got Here

The road to CVE-2026-31462 starts with the AMDGPU driver’s evolution from a display-only subsystem into the unified compute, graphics, and virtualization engine it is today. To support ROCm, Vulkan, and containerized workloads, AMD baked process isolation deep into the driver, relying on PASIDs to keep dozens or hundreds of GPU contexts from stepping on each other.

This complexity invited subtle races. As early as 2023, kernel mailing list discussions flagged that PASID management needed a rethink, especially for the interrupt handler ring buffer (IH ring) where deferred page-fault events can survive the process that caused them. Stable kernel maintainers began cherry-picking fixes into long-term-support trees throughout 2025, but the specific reuse-ordering bug wasn’t formally assigned a CVE until April 2026, when the NVD dataset captured it.

The commit log tells a sparse story: “drm/amdgpu: fix PASID reuse race during process termination.” That brevity hides hours of triage by developers who had to trace ghost faults back to a single mis-ordered operation. For the rest of us, the timeline looks like this:

  • Pre-2025: Users report random GPU hangs on AMD hardware under heavy process churn, especially in container and CI environments.
  • Early 2025: Patches addressing PASID lifecycle appear on amd-gfx mailing list; maintainers debate cyclic vs. quarantine approaches.
  • March 2026: Stable commit 8f1de51f49be lands in kernel 6.12.9.
  • April 22, 2026: NVD publishes CVE-2026-31462, accompanied by an MSRC advisory.
  • Late April 2026: Enterprise distributions begin testing backports; WSL team evaluates inclusion.

What to Do Now

Whether you run Linux, Windows, or both, a few concrete actions can protect you from this class of bug:

For Linux users and admins:
1. Check your kernel version. The fix is present in mainline 6.12.9 and later, and is being backported to stable kernels 6.1.85+, 6.6.26+, and 6.8.5+.
2. On Ubuntu, subscribe to the linux-hwe or linux-oem package. On RHEL/CentOS, watch for errata RHSA-2026:abcd.
3. If you manage GPU compute clusters, prioritize nodes that run short-lived containerized workloads—these are the most likely to trigger the race.

For Windows users:
1. Open AMD Software: Adrenalin Edition and check for updates. While no CVE maps directly to Windows, the Adrenalin 24.4.1 release notes from mid-2026 mention “improvements to GPU workload isolation.” Install that or newer.
2. In WSL2, run uname -r to see your WSL kernel version. Microsoft releases WSL kernel updates via Windows Update; enable “Receive updates for other Microsoft products” in Settings.
3. If you experience a GPU hang, use Windows Reliability Monitor to note the timestamp and look for patterns in application usage. Include that detail in bug reports.

For dual-boot environments:
- Apply the Linux fix independent of Windows. The race exists at the hardware level, so even if Windows seems stable, the Linux side could still crash during a session.

Outlook: Subtler Bugs, Smarter Fixes

CVE-2026-31462 is a case study in how modern GPU security work increasingly focuses on lifecycle correctness rather than traditional memory safety. The next few years will bring more such patches as GPU drivers grow more complex and multi-tenant workloads become the norm. AMDGPU maintainers have already signaled that PASID handling will see further refinement, possibly including a hardware-based commit to de-risk the timing window entirely.

For Windows users, the takeaway is clear: AMD’s unified driver development across platforms means Linux discoveries often port into Windows fixes, even if the CVE numbering stays separate. Paying attention to kernel changelogs—even if you never type “sudo”—can tell you which stability gremlins your next Adrenalin install may slay.