CVE-2026-99106: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

CVE-2026-99106: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of
the BO list and looks up the user pages. Those ranges are only freed when
amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks
them under the notifier lock. If amdgpu_cs_patch_jobs(),
amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of
amdgpu_cs_submit() fails, nothing frees them: neither
amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.

Each such CS then leaks the range, its hmm_pfns array (8 bytes per page
of the userptr BO) and the BO reference the range holds. An IB on a ring
that patches the CS in place (e.g. VCN) with an unmapped va_start fails
in amdgpu_cs_patch_ibs() and takes this path.

Free the ranges on those error paths. Ranges amdgpu_cs_submit() already
dropped are NULL, so freeing them again is a no-op.

(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

The Linux kernel CVE team has assigned CVE-2026-99106 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.2 with commit fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 and fixed in 6.18.59 with commit 6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
	Issue introduced in 6.2 with commit fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 and fixed in 7.2.13 with commit 2d9d24385201f476a2f754495b71bbac5ba6ea7b
	Issue introduced in 6.2 with commit fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 and fixed in 7.3 with commit 1b4da805a0ba354a549ce07459c871c17dd94fe0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-99106
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
	https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b
	https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0