PT-2026-121921
CVE-2026-98949
·
Publicado
2026-10-23
·
Atualizado
2026-10-23
Descrição por
Pontuação
N/A
Não disponívelNão há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Fix reference and vm bo handling in remap()
When a map overlaps part of an existing mapping, pvr vm gpuva remap()
splits the mapping into prev/next parts covering what the request did
not take, instead of creating something new. It gets two things wrong.
-
A GEM reference is taken for each part but it's never needed and never dropped, so it leaks one reference per split (remap-next-in-2m in tests/imagination/pvr vm map.c):CRITICAL: 33558528 bytes of shmem still held after close
-
The parts still belong to the original object being split, but pvr vm gpuva remap() links them to ctx->gpuvm bo, the new object's vm bo:prev va --obj--> BO A BO B <--obj-- vm bo (ctx->gpuvm bo) link / (mismatch: BO A != BO B)
drm gpuva link() catches the mismatch:
WARNING: drivers/gpu/drm/drm gpuvm.c:2108 at drm gpuva link+0x2ec/0x310
drm WARN ON(obj != vm bo->obj)
Call trace:
drm gpuva link
pvr vm gpuva remap
drm gpuvm sm map
pvr vm map
pvr ioctl vm map
Link them to op->remap.unmap->va->vm bo instead.
The locking of the GPUVA lists of the other objects touched by a split is
not addressed here; it is handled by switching the GPUVM to immediate
mode.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾