PT-2026-128099
CVE-2026-99106
·
Published
2026-10-28
·
Updated
2026-10-28
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: free the userptr ranges when a CS fails after parser bos
amdgpu cs parser bos() allocates an HMM range for every userptr entry of
the BO list and looks up the user pages. Those ranges are only freed when
amdgpu cs parser bos() itself fails or when amdgpu cs submit() checks
them under the notifier lock. If amdgpu cs patch jobs(),
amdgpu cs vm handling(), amdgpu cs sync rings() or the early part of
amdgpu cs submit() fails, nothing frees them: neither
amdgpu cs parser fini() nor amdgpu bo list free() touch e->range.
Each such CS then leaks the range, its hmm pfns array (8 bytes per page
of the userptr BO) and the BO reference the range holds. An IB on a ring
that patches the CS in place (e.g. VCN) with an unmapped va start fails
in amdgpu cs patch ibs() and takes this path.
Free the ranges on those error paths. Ranges amdgpu cs submit() already
dropped are NULL, so freeing them again is a no-op.
(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)
Found an issue in the description? Have something to add? Feel free to write us 👾