CVE-2026-98784: drm/amdgpu/gfx6: fix firmware leak on teardown
drm/amdgpu/gfx6: fix firmware leak on teardown
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 386e81346f95ab0be5a82c5535de932e7a456924
Event History
Frequently Asked Questions
Which systems are affected by this resource leak?
The issue is in the Linux kernel's AMDGPU GFX6 code path. Systems using AMD GPUs handled by that GFX6 driver path are the relevant exposure population.
When does the leak occur?
The firmware resources leak when the GFX block is torn down, because the PFP, ME, CE, and RLC firmware obtained during microcode initialization is not released.
What is the remediation?
Apply a kernel update containing the fix that adds gfx_v6_0_free_microcode() and invokes it during gfx_v6_0_sw_fini(). The supplied stable-kernel references identify backports of the fix.