Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range. Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path. Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund28 Oct 2026WID-SEC-2026-4224

  Linux Kernel: Multiple vulnerabilities allow an unspecified attack Translated from German

  CVE-2026-99116CVE-2026-99143CVE-2026-99170+113 more CVEs

[ References ]References

• git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0
• git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b
• git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
• git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2
• git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b