CVE-2026-99106 drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99106?
CVE-2026-99106 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.
Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path.
Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op.
(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)
Which versions are affected by CVE-2026-99106?
How do I fix CVE-2026-99106?
Upgrade to a fixed version.
Is CVE-2026-99106 being exploited?
There is no known exploitation of CVE-2026-99106 in the wild and no public exploit code.
Sources
Also known as AZL-111194, BELL-CVE-2026-99106, DEBIAN-CVE-2026-99106, GHSA-54r4-5mx4-49pg, UBUNTU-CVE-2026-99106.