CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: free the userptr ranges when a CS fails after parser bos

amdgpu cs parser bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu cs parser bos() itself fails or when amdgpu cs submit() checks them under the notifier lock. If amdgpu cs patch jobs(), amdgpu cs vm handling(), amdgpu cs sync rings() or the early part of amdgpu cs submit() fails, nothing frees them: neither amdgpu cs parser fini() nor amdgpu bo list free() touch e->range.

Each such CS then leaks the range, its hmm pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va start fails in amdgpu cs patch ibs() and takes this path.

Free the ranges on those error paths. Ranges amdgpu cs submit() already dropped are NULL, so freeing them again is a no-op.

(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)