DEBIAN-CVE-2026-99106: Debian/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos() itself fails or when amdgpucssubmit() checks them under the notifier lock. If amdgpucspatchjobs(), amdgpucsvmhandling(), amdgpucssyncrings() or the early part of amdgpucssubmit() fails, nothing frees them: neither amdgpucsparserfini() nor amdgpubolistfree() touch e->range. Each such CS then leaks the range, its hmmpfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped vastart fails in amdgpucspatchibs() and takes this path. Free the ranges on those error paths. Ranges amdgpucssubmit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)