CVE-2026-99106

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99106", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.391Z", "datePublished": "2026-10-28T10:34:25.279Z", "dateUpdated": "2026-10-30T12:41:47.227Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:47.227Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: free the userptr ranges when a CS fails after parser_bos\n\namdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of\nthe BO list and looks up the user pages. Those ranges are only freed when\namdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks\nthem under the notifier lock. If amdgpu_cs_patch_jobs(),\namdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of\namdgpu_cs_submit() fails, nothing frees them: neither\namdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.\n\nEach such CS then leaks the range, its hmm_pfns array (8 bytes per page\nof the userptr BO) and the BO reference the range holds. An IB on a ring\nthat patches the CS in place (e.g. VCN) with an unmapped va_start fails\nin amdgpu_cs_patch_ibs() and takes this path.\n\nFree the ranges on those error paths. Ranges amdgpu_cs_submit() already\ndropped are NULL, so freeing them again is a no-op.\n\n(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"], "versions": [{"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "lessThan": "e265221019d20fa162b62baec16c44b5b2ea295b", "status": "affected", "versionType": "git"}, {"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "lessThan": "79179efd1ad4729cf0ff9e15eb9414f883e4aec2", "status": "affected", "versionType": "git"}, {"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "lessThan": "6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a", "status": "affected", "versionType": "git"}, {"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "lessThan": "2d9d24385201f476a2f754495b71bbac5ba6ea7b", "status": "affected", "versionType": "git"}, {"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "lessThan": "1b4da805a0ba354a549ce07459c871c17dd94fe0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b"}, {"url": "https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2"}, {"url": "https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a"}, {"url": "https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b"}, {"url": "https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0"}], "title": "drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e265221019d20fa162b62baec16c44b5b2ea295b", "status": "affected", "version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "versionType": "git"}, {"lessThan": "79179efd1ad4729cf0ff9e15eb9414f883e4aec2", "status": "affected", "version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "versionType": "git"}, {"lessThan": "6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a", "status": "affected", "version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "versionType": "git"}, {"lessThan": "2d9d24385201f476a2f754495b71bbac5ba6ea7b", "status": "affected", "version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "versionType": "git"}, {"lessThan": "1b4da805a0ba354a549ce07459c871c17dd94fe0", "status": "affected", "version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: free the userptr ranges when a CS fails after parser_bos\n\namdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of\nthe BO list and looks up the user pages. Those ranges are only freed when\namdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks\nthem under the notifier lock. If amdgpu_cs_patch_jobs(),\namdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of\namdgpu_cs_submit() fails, nothing frees them: neither\namdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.\n\nEach such CS then leaks the range, its hmm_pfns array (8 bytes per page\nof the userptr BO) and the BO reference the range holds. An IB on a ring\nthat patches the CS in place (e.g. VCN) with an unmapped va_start fails\nin amdgpu_cs_patch_ibs() and takes this path.\n\nFree the ranges on those error paths. Ranges amdgpu_cs_submit() already\ndropped are NULL, so freeing them again is a no-op.\n\n(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)"}], "id": "CVE-2026-99106", "lastModified": "2026-10-30T13:21:45.427", "metrics": {}, "published": "2026-10-28T11:17:29.960", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", "id": "2562719", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562719"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: free the userptr ranges when a CS fails after parser_bos\namdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of\nthe BO list and looks up the user pages. Those ranges are only freed when\namdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks\nthem under the notifier lock. If amdgpu_cs_patch_jobs(),\namdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of\namdgpu_cs_submit() fails, nothing frees them: neither\namdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.\nEach such CS then leaks the range, its hmm_pfns array (8 bytes per page\nof the userptr BO) and the BO reference the range holds. An IB on a ring\nthat patches the CS in place (e.g. VCN) with an unmapped va_start fails\nin amdgpu_cs_patch_ibs() and takes this path.\nFree the ranges on those error paths. Ranges amdgpu_cs_submit() already\ndropped are NULL, so freeing them again is a no-op.\n(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)", "A flaw was found in the Linux kernel's AMDGPU driver. This vulnerability allows a local attacker to cause a Denial of Service (DoS) through kernel memory exhaustion. When command submission operations fail during certain error-handling paths, allocated memory ranges and buffer object references are not properly freed. By repeatedly submitting requests that trigger these failure conditions, an attacker can continuously leak memory until system resources are depleted."], "name": "CVE-2026-99106", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99106\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99106\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99106.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fec8fdb54e8f74d88951c9f998f47bf4f2031fe0,6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fec8fdb54e8f74d88951c9f998f47bf4f2031fe0,2d9d24385201f476a2f754495b71bbac5ba6ea7b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fec8fdb54e8f74d88951c9f998f47bf4f2031fe0,1b4da805a0ba354a549ce07459c871c17dd94fe0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.2,6.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fec8fdb54e8f74d88951c9f998f47bf4f2031fe0,6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fec8fdb54e8f74d88951c9f998f47bf4f2031fe0,2d9d24385201f476a2f754495b71bbac5ba6ea7b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fec8fdb54e8f74d88951c9f998f47bf4f2031fe0,1b4da805a0ba354a549ce07459c871c17dd94fe0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.2,6.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T11:45:09.773327+00:00", "updated": "2026-10-29T18:45:14.343813+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}