CVE-2026-99149 drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

Not scored Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-99149?

CVE-2026-99149 is a vulnerability in Linux, published on 28 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind.

Use release_object here, not user_pages_done, range is still NULL at this point.

(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)

Which versions are affected by CVE-2026-99149?

How do I fix CVE-2026-99149?

Upgrade to a fixed version.

Is CVE-2026-99149 being exploited?

There is no known exploitation of CVE-2026-99149 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-99149, GHSA-7fj6-92pf-cvxq, UBUNTU-CVE-2026-99149.