AZL-111194: CVE-2026-99106 affecting package kernel 6.6.157.1-1

Q: Which workloads are most likely to trigger the leak?

The issue is in the AMDGPU command-submission path for userptr buffer objects. A documented trigger is an instruction buffer on a ring that patches command submissions in place, such as VCN, when it has an unmapped va_start and fails during IB patching.

Q: What happens when the vulnerable error paths are reached?

Each failed command submission can leak the HMM range, its hmm_pfns allocation, and the buffer-object reference held by the range. The hmm_pfns allocation consumes 8 bytes for every page in the userptr buffer object.

Q: Are all command-submission failures affected?

No. The leak applies when failures occur after amdgpu_cs_parser_bos() has allocated userptr ranges and before the paths that normally release them. The described affected failures include amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings(), and the early portion of amdgpu_cs_submit().

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: free the userptr ranges when a CS fails after parserbos

amdgpucsparserbos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos() itself fails or when amdgpucssubmit() checks them under the notifier lock. If amdgpucspatchjobs(), amdgpucsvmhandling(), amdgpucssyncrings() or the early part of amdgpucssubmit() fails, nothing frees them: neither amdgpucsparserfini() nor amdgpubolistfree() touch e->range.

Each such CS then leaks the range, its hmmpfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped vastart fails in amdgpucspatchibs() and takes this path.

Free the ranges on those error paths. Ranges amdgpucssubmit() already dropped are NULL, so freeing them again is a no-op.

(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade kernel to a version that resolves this vulnerability.
Patch c52a9542ed7cfd527feb938bd0accada2ac8d267

Event History

Oct 28, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99106

Frequently Asked Questions

Which workloads are most likely to trigger the leak?

The issue is in the AMDGPU command-submission path for userptr buffer objects. A documented trigger is an instruction buffer on a ring that patches command submissions in place, such as VCN, when it has an unmapped va_start and fails during IB patching.

What happens when the vulnerable error paths are reached?

Each failed command submission can leak the HMM range, its hmm_pfns allocation, and the buffer-object reference held by the range. The hmm_pfns allocation consumes 8 bytes for every page in the userptr buffer object.

Are all command-submission failures affected?

No. The leak applies when failures occur after amdgpu_cs_parser_bos() has allocated userptr ranges and before the paths that normally release them. The described affected failures include amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings(), and the early portion of amdgpu_cs_submit().

AZL-111194: CVE-2026-99106 affecting package kernel 6.6.157.1-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which workloads are most likely to trigger the leak?

What happens when the vulnerable error paths are reached?

Are all command-submission failures affected?

Company

Resources

Contact

Frequently Asked Questions

Which workloads are most likely to trigger the leak?

What happens when the vulnerable error paths are reached?

Are all command-submission failures affected?