CVE-2026-52987: drm/amdgpu: avoid double drm_exec_fini() in userq validate
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid double drmexecfini() in userq validate
When newaddition is true, amdgpuuserqvmvalidate() calls drmexecfini(&exec) before iterating over the collected HMM ranges and calling amdgputtmttgetuserpages().
If amdgputtmttgetuserpages() fails in that path, the code jumps to unlockall and calls drmexecfini(&exec) a second time on the same exec object. drmexecfini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context.
Route that error path directly to the range cleanup once exec has already been finalized.
Issue found using a prototype static analysis tool and confirmed by code review.
(cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure drm_exec_fini(exec) is not called twice during drm/amdgpu userq validation (avoid the second drm_exec_fini() after collecting HMM ranges/unlock_all, since drm_exec_fini() is not idempotent and frees exec->objects).
Event History
Frequently Asked Questions
Who can exploit this issue?
The severity vector indicates local access with low privileges is required. No user interaction is required.
What runtime conditions are needed to trigger the vulnerable path?
The affected path requires amdgpu userq VM validation with new_addition set, followed by a failure from amdgpu_ttm_tt_get_user_pages() while processing collected HMM ranges. That error path can finalize the same drm_exec object twice.
How should this be remediated?
Apply a Linux kernel build containing the fix that routes this post-finalization error path directly to range cleanup. The supplied stable-kernel references identify commits c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38 and 508babf310365f1107a2e8831c267c292a286818.