DEBIAN-CVE-2026-99149: Debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc() fails amdgpugemuserptrioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind. Use releaseobject here, not userpagesdone, range is still NULL at this point. (cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel drm/amdgputo a version that resolves this vulnerability.Patch bbe739e407a542073ec1a7872b14843566b4919e
Event History
Frequently Asked Questions
What conditions trigger the leak?
The affected path is reached when the AMDGPU userptr ioctl calls amdgpu_hmm_range_alloc() and that allocation fails with ENOMEM. The error return bypasses the normal cleanup path.
What resources can remain allocated after the failure?
The GEM object, the buffer object's parent reference on the VM root, and the MMU notifier registration can be left behind. The range is still NULL at this point, so cleanup must release the object rather than run user_pages_done.