CVE-2026-99149unknown
drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| e095b55155ef69a8ae0eb114a7fd2a381c012f33 to before 64a6d40156ae98caafc922c6d79fe202b0acd836 | affected |
| e095b55155ef69a8ae0eb114a7fd2a381c012f33 to before 3c516a5646285442e1cd71dff2584b77eb4fc421 | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 6.19 | affected |
| 0 to before 6.19 | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind.
Use release_object here, not user_pages_done, range is still NULL at this point.
(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)