PT-2026-128099
CVE-2026-99106
·
Publicado
2026-10-28
·
Atualizado
2026-10-28
Descrição por
Pontuação
N/A
Não disponívelNão há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: free the userptr ranges when a CS fails after parser bos
amdgpu cs parser bos() allocates an HMM range for every userptr entry of
the BO list and looks up the user pages. Those ranges are only freed when
amdgpu cs parser bos() itself fails or when amdgpu cs submit() checks
them under the notifier lock. If amdgpu cs patch jobs(),
amdgpu cs vm handling(), amdgpu cs sync rings() or the early part of
amdgpu cs submit() fails, nothing frees them: neither
amdgpu cs parser fini() nor amdgpu bo list free() touch e->range.
Each such CS then leaks the range, its hmm pfns array (8 bytes per page
of the userptr BO) and the BO reference the range holds. An IB on a ring
that patches the CS in place (e.g. VCN) with an unmapped va start fails
in amdgpu cs patch ibs() and takes this path.
Free the ranges on those error paths. Ranges amdgpu cs submit() already
dropped are NULL, so freeing them again is a no-op.
(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾