UBUNTU-CVE-2026-99106: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos() itself fails or when amdgpucssubmit() checks them under the notifier lock. If amdgpucspatchjobs(), amdgpucsvmhandling(), amdgpucssyncrings() or the early part of amdgpucssubmit() fails, nothing frees them: neither amdgpucsparserfini() nor amdgpubolistfree() touch e->range. Each such CS then leaks the range, its hmmpfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped vastart fails in amdgpucspatchibs() and takes this path. Free the ranges on those error paths. Ranges amdgpucssubmit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel drm/amdgputo a version that resolves this vulnerability.Patch c52a9542ed7cfd527feb938bd0accada2ac8d267
Event History
Frequently Asked Questions
What conditions are needed for the resource leak to occur?
A command submission must include userptr buffer objects, successfully allocate their HMM ranges during buffer parsing, and then fail in a later command-submission stage. Failures in command patching, VM handling, ring synchronization, or the early part of submission can take this path; a VCN in-place patching submission with an unmapped va_start is one example.
What is leaked by each affected failed submission?
Each failure can retain the HMM range, its hmm_pfns array at 8 bytes per userptr-BO page, and the buffer-object reference held by the range. Repeated failures can therefore accumulate kernel memory and retained BO references.