GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
CVE-2026-99106unknown

drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

Impact

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Linux · Linux

Other versions: unaffected

Version / rangeSource status
fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 to before 6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9aaffected
fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 to before 2d9d24385201f476a2f754495b71bbac5ba6ea7baffected
fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 to before 1b4da805a0ba354a549ce07459c871c17dd94fe0affected
Linux version evidence

Linux · Linux

Other versions: affected

Version / rangeSource status
6.2affected
0 to before 6.2unaffected
6.18.59 through 6.18.* (inclusive)unaffected
7.2.13 through 7.2.* (inclusive)unaffected
7.3 through * (inclusive)unaffected
Linux version evidence

Original source description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.

Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path.

Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op.

(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

References