CVE-2026-99106drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range. Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path. Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)
Timeline
ID reserved
By Linux
- 33 days later
· 33 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 – < e265221019d20fa162b62baec16c44b5b2ea295b
- affected fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 – < 79179efd1ad4729cf0ff9e15eb9414f883e4aec2
- affected fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 – < 6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
- affected fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 – < 2d9d24385201f476a2f754495b71bbac5ba6ea7b
- affected fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 – < 1b4da805a0ba354a549ce07459c871c17dd94fe0
- affected 6.2
- unaffected < 6.2
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b (opens in a new tab)
- https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2 (opens in a new tab)
- https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a (opens in a new tab)
- https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b (opens in a new tab)
- https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-112006 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99106)Record last updated .