From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793187477; b=aGuE0Yw4FKheSgIvze2v6o1TeKNniNNpMISphHDGjegOEVfCEQBrgt1d86kYhBKAs6nV kQCPHkKbWTjvh0pKRYE0oZGxN39hximWQ+zO+fxD9U3TcjEtADHUAUOILb+7PJnQURlrS tUGqUtugR+P6zdBsvz7pWddH831m/iJzxYdXZBYyLt2liV6EGI+kOrINwMl9TjKxy1zeu Fig4x1xun6IP5OPxUgandwF2gznEKYPuYrGforBOJDyI/QCBwzHyWVc59abepWs2ETWPU m3bxAYapE0Vs/HL7/gpTgxaLD0T01lnP0KHaUpjqUDMeIXxWVjqBH7xGhYjm+yNmIyg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793187477; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=spWO/ZuCl1LuQE83aUmLk0d/JTuCpEekP9a5xWPop4U=; b=3yrVx8hsF33sM6UiBdZGBT4vuBXPAB1G1nZUnUiIFykjWjS7upiUbt00IgfN0LkejXLu WsnC8OJ0DJcoDX0lsxYI7cRn1Ti0oLWYGnCG/ZTRls7jbWeFSiFZAExpl5Gjt1Y+dy6kj 7PvFDn/kZ2AOrA0KPzbA4x9mlX52SjUsHjFTPVi9BpBiZcSDkkSiEkn3iakw7nXN+XqSg 2MoorZGgfcYqYYc+7Il4R04Z5CUsb6UWiksuiJloWzprlyFgXKJC1hGKUmdJGVamM4GUR UQ744DT8XKZc84Xl/dY37Y2T3/oDbvdb+LXLwIaHG5nahavo/9xTGGNSv945+3CEwGg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=FEj7nJc7; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB75F606A31A for ; Wed, 28 Oct 2026 11:37:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=FEj7nJc7 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 262361F01825; Wed, 28 Oct 2026 11:37:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793187476; bh=spWO/ZuCl1LuQE83aUmLk0d/JTuCpEekP9a5xWPop4U=; h=From:To:Cc:Subject:Date:Reply-To; b=FEj7nJc7UXxQkHIVppLacdFrTYn2OJSjbrlCcfZN/lpkQo5Vc4RygJFqVOV4agIqt lUuQo+r4CjyU/ob3Fp0iUHnPUlkPRzYh3dMn7A372hnyXzvDD0DCxuM8e1PV9ksYdc w5T41bwsxxp9CmO+JS1MUHZv3JPoyIgo82MuHhBU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-99106: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos Date: Wed, 28 Oct 2026 11:34:53 +0100 Message-ID: <2026102853-CVE-2026-99106-e89a@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2952; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=rVP1621d+LonC4Dj/Ut2tSF//UrxlOWnN9h5IOb2k7A=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkPz5+t+vp3EdvR2WV/DfVqq9c68N5ZJ1LY8feFT+GxT Herm4/2dsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBE+nwYFmxSe2AxXT07qUw0 XSd29ZnLq6qNLRnm5xbtUFI+pXv6/8motuVXs526q1dIAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range. Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path. Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op. (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267) The Linux kernel CVE team has assigned CVE-2026-99106 to this issue. Affected and fixed versions =========================== Issue introduced in 6.2 with commit fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 and fixed in 6.18.59 with commit 6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a Issue introduced in 6.2 with commit fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 and fixed in 7.2.13 with commit 2d9d24385201f476a2f754495b71bbac5ba6ea7b Issue introduced in 6.2 with commit fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 and fixed in 7.3 with commit 1b4da805a0ba354a549ce07459c871c17dd94fe0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-99106 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0