CVE-2026-99106: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range. Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path. Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

Засегнати продукти

• Linux Linux: fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 преди e265221019d20fa162b62baec16c44b5b2ea295b; fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 преди 79179efd1ad4729cf0ff9e15eb9414f883e4aec2; fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 преди 6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a; fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 преди 2d9d24385201f476a2f754495b71bbac5ba6ea7b; fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 преди 1b4da805a0ba354a549ce07459c871c17dd94fe0
• Linux Linux: 6.2; преди 6.2; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-99106
• https://nvd.nist.gov/vuln/detail/CVE-2026-99106
• https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b
• https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2
• https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
• https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b
• https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0