{"id":"CVE-2026-99106","revision":"d96e9d5e9d0845a688f482242f32f712","records":[{"revision":"d96e9d5e9d0845a688f482242f32f712","observedAt":"2026-10-28T11:27:43.363+00:00","statement":{"source":"cve-program","id":"CVE-2026-99106","aliases":[],"title":"drm/amdgpu: free the userptr ranges when a CS fails after parser_bos","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: free the userptr ranges when a CS fails after parser_bos\n\namdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of\nthe BO list and looks up the user pages. Those ranges are only freed when\namdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks\nthem under the notifier lock. If amdgpu_cs_patch_jobs(),\namdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of\namdgpu_cs_submit() fails, nothing frees them: neither\namdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.\n\nEach such CS then leaks the range, its hmm_pfns array (8 bytes per page\nof the userptr BO) and the BO reference the range holds. An IB on a ring\nthat patches the CS in place (e.g. VCN) with an unmapped va_start fails\nin amdgpu_cs_patch_ibs() and takes this path.\n\nFree the ranges on those error paths. Ranges amdgpu_cs_submit() already\ndropped are NULL, so freeing them again is a no-op.\n\n(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)","state":0,"publishedAt":"2026-10-28T10:34:25.279+00:00","modifiedAt":"2026-10-28T10:34:25.279+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fec8fdb54e8f74d88951c9f998f47bf4f2031fe0\",\n                            \"lessThan\": \"6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fec8fdb54e8f74d88951c9f998f47bf4f2031fe0\",\n                            \"lessThan\": \"2d9d24385201f476a2f754495b71bbac5ba6ea7b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fec8fdb54e8f74d88951c9f998f47bf4f2031fe0\",\n                            \"lessThan\": \"1b4da805a0ba354a549ce07459c871c17dd94fe0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a","https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b","https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99106","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99106","identifiers":["CVE-2026-99106"]},"retained":false,"historicalAffected":[]}],"coverage":[]}