In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: amdgputtmgart_bind set gtt bound flag
Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgputtmbackend_unbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue.