UBUNTU-CVE-2026-99149: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc() fails amdgpugemuserptrioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind. Use releaseobject here, not userpagesdone, range is still NULL at this point. (cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel drm/amdgputo a version that resolves this vulnerability.Patch bbe739e407a542073ec1a7872b14843566b4919e
Event History
Frequently Asked Questions
What conditions are required to trigger the leak?
The failure path is triggered when amdgpu_hmm_range_alloc() fails during the AMDGPU userptr ioctl. The affected ioctl path must be exercised, and the allocation must fail with ENOMEM.
What resources remain allocated when the issue occurs?
The GEM object is leaked, along with the bo->parent reference on the VM root and the MMU notifier registration. The normal error-path cleanup is skipped because the ioctl returns immediately.
How can the issue be recognized in code or crash-path analysis?
Look for amdgpu_gem_userptr_ioctl() returning -ENOMEM directly after amdgpu_hmm_range_alloc() fails. In the corrected path, release_object is used rather than user_pages_done because the range is still NULL.