CVE-2026-99150 drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99150?
CVE-2026-99150 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count:
amdgpu 0000:03:00.0: Runtime PM usage count underflow!
The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path.
(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)
Which versions are affected by CVE-2026-99150?
How do I fix CVE-2026-99150?
Upgrade to a fixed version.
Is CVE-2026-99150 being exploited?
There is no known exploitation of CVE-2026-99150 in the wild and no public exploit code.
Sources
Also known as AZL-111281, BELL-CVE-2026-99150, DEBIAN-CVE-2026-99150, GHSA-9m2r-pjhq-4578, UBUNTU-CVE-2026-99150.