CVE-2026-99149

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99149", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.396Z", "datePublished": "2026-10-28T10:35:05.015Z", "dateUpdated": "2026-10-28T10:35:05.015Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-28T10:35:05.015Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl\n\nWhen amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns\n-ENOMEM right away and skips the cleanup every other error path goes\nthrough. The GEM object, the bo->parent reference on the VM root and the\nMMU notifier registration are all left behind.\n\nUse release_object here, not user_pages_done, range is still NULL at\nthis point.\n\n(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"], "versions": [{"version": "e095b55155ef69a8ae0eb114a7fd2a381c012f33", "lessThan": "64a6d40156ae98caafc922c6d79fe202b0acd836", "status": "affected", "versionType": "git"}, {"version": "e095b55155ef69a8ae0eb114a7fd2a381c012f33", "lessThan": "3c516a5646285442e1cd71dff2584b77eb4fc421", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/64a6d40156ae98caafc922c6d79fe202b0acd836"}, {"url": "https://git.kernel.org/stable/c/3c516a5646285442e1cd71dff2584b77eb4fc421"}], "title": "drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "64a6d40156ae98caafc922c6d79fe202b0acd836", "status": "affected", "version": "e095b55155ef69a8ae0eb114a7fd2a381c012f33", "versionType": "git"}, {"lessThan": "3c516a5646285442e1cd71dff2584b77eb4fc421", "status": "affected", "version": "e095b55155ef69a8ae0eb114a7fd2a381c012f33", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl\n\nWhen amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns\n-ENOMEM right away and skips the cleanup every other error path goes\nthrough. The GEM object, the bo->parent reference on the VM root and the\nMMU notifier registration are all left behind.\n\nUse release_object here, not user_pages_done, range is still NULL at\nthis point.\n\n(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)"}], "id": "CVE-2026-99149", "lastModified": "2026-10-28T11:17:34.990", "metrics": {}, "published": "2026-10-28T11:17:34.990", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c516a5646285442e1cd71dff2584b77eb4fc421"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64a6d40156ae98caafc922c6d79fe202b0acd836"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: amdgpu: Denial of Service via resource leak in amdgpu_gem_userptr_ioctl", "id": "2562648", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562648"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl\nWhen amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns\n-ENOMEM right away and skips the cleanup every other error path goes\nthrough. The GEM object, the bo->parent reference on the VM root and the\nMMU notifier registration are all left behind.\nUse release_object here, not user_pages_done, range is still NULL at\nthis point.\n(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)", "A flaw was found in the AMDGPU graphics driver within the Linux kernel. When memory allocation fails during user pointer memory validation in the amdgpu_gem_userptr_ioctl function, the driver immediately returns an error and bypasses required cleanup routines. This issue causes Graphics Execution Manager (GEM) objects and related tracking references to remain allocated in memory. A local user could trigger this failure to repeatedly leak kernel resources, potentially leading to a Denial of Service (DoS) through memory exhaustion."], "name": "CVE-2026-99149", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99149\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99149\nhttps://git.kernel.org/stable/c/3c516a5646285442e1cd71dff2584b77eb4fc421\nhttps://git.kernel.org/stable/c/64a6d40156ae98caafc922c6d79fe202b0acd836"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[e095b55155ef69a8ae0eb114a7fd2a381c012f33,64a6d40156ae98caafc922c6d79fe202b0acd836)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[e095b55155ef69a8ae0eb114a7fd2a381c012f33,3c516a5646285442e1cd71dff2584b77eb4fc421)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[e095b55155ef69a8ae0eb114a7fd2a381c012f33,64a6d40156ae98caafc922c6d79fe202b0acd836)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[e095b55155ef69a8ae0eb114a7fd2a381c012f33,3c516a5646285442e1cd71dff2584b77eb4fc421)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:15:14.881072+00:00", "updated": "2026-10-30T05:30:09.651549+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}