{"id":"CVE-2026-98519","kind":"vulnerability","aliases":["CVE-2026-98519"],"related":[],"title":"Linux amdgpu driver leaks a GPU power reference on interrupted debugfs read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()\n\namdgpu_debugfs_test_ib_show() resumes the device with\npm_runtime_get_sync() before taking the reset domain semaphore with\ndown_write_killable().  If the write lock acquisition is interrupted,\nthe function returns without calling pm_runtime_put_autosuspend(),\nleaking the runtime PM reference acquired for the device and keeping\nthe GPU awake.\n\nDrop the runtime PM reference on the interrupted down_write_killable()\nerror path before returning.\n\n(cherry picked from commit ec30a576c2d4c0364549e6c04218f50704ef56c8)","summary":"In the amdgpu graphics driver's debugfs test-IB show routine, an interrupted lock acquisition returns without dropping the runtime PM reference taken for the device. The GPU is then kept awake, which wastes power and blocks suspend, with no sign that an attacker gains code execution or data access.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-gpu","amdgpu","linux-kernel","runtime","workstations"],"not_affected_if":["amdgpu-not-loaded","no-amd-gpu"],"how_to_check":"- `uname -r` and check whether the running kernel includes the upstream commit ec30a576c2d4c0364549e6c04218f50704ef56c8 or a stable backport of it\n- unknown","fix":"- Update the Linux kernel to a stable release that includes the backport of commit ec30a576c2d4c0364549e6c04218f50704ef56c8\n- unknown","status":"open","published_at":"2026-10-18T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:14+00:00","updated_at":"2026-10-25T05:25:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:25:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the backport of commit ec30a576c2d4c0364549e6c04218f50704ef56c8\n- unknown","reach":"local","title":"Linux amdgpu driver leaks a GPU power reference on interrupted debugfs read","impact":"low","summary":"In the amdgpu graphics driver's debugfs test-IB show routine, an interrupted lock acquisition returns without dropping the runtime PM reference taken for the device. The GPU is then kept awake, which wastes power and blocks suspend, with no sign that an attacker gains code execution or data access.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","amd-gpu","amdgpu","workstations"],"confidence":0.6,"needs_auth":"unknown","worst_case":"GPU stays awake, wasting power and blocking suspend","analyst_note":"","how_to_check":"- `uname -r` and check whether the running kernel includes the upstream commit ec30a576c2d4c0364549e6c04218f50704ef56c8 or a stable backport of it\n- unknown","needs_analyst":false,"not_affected_if":["no-amd-gpu","amdgpu-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the amdgpu driver for AMD GPUs, where the debugfs test-IB interface is present. The sources do not describe a trigger that a non-root user can reach, so machines without AMD GPUs or without the amdgpu driver can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000629,"input_tokens":3474,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98519':15A,18A 'access':78B 'acquir':144C 'acquisit':43B,127C 'amd':20B 'amd-gpu':19B 'amdgpu':2A,22B,30B,95C,100C 'attack':72B 'autosuspend':138C 'awak':60B,152C 'block':65B 'call':134C 'cherri':168C 'code':74B 'commit':171C 'cve':13A,16A 'data':77B 'debugf':11A,34B,96C,101C 'devic':54B,107C,147C 'domain':117C 'driver':3A,32B 'drm/amdgpu':89C 'drop':46B,153C 'ec30a576c2d4c0364549e6c04218f50704ef56c8':172C 'error':164C 'execut':75B 'fix':90C 'follow':84C 'function':131C 'gain':73B 'get':111C 'gpu':6A,21B,56B,151C 'graphic':31B 'ib':37B,98C,103C 'interrupt':10A,41B,129C,160C 'keep':149C 'kept':59B 'kernel':25B,82C 'killabl':122C,163C 'leak':4A,93C,139C 'linux':1A,24B,81C 'linux-kernel':23B 'lock':42B,126C 'path':165C 'pick':169C 'pm':49B,92C,109C,135C,142C,156C 'power':7A,63B 'put':137C 'read':12A 'refer':8A,50B,143C,157C 'reset':116C 'resolv':88C 'resum':105C 'return':44B,132C,167C 'routin':39B 'runtim':26B,48B,91C,110C,136C,141C,155C 'semaphor':118C 'show':38B,99C,104C 'sign':69B 'suspend':66B 'sync':112C 'take':114C 'taken':51B 'test':36B,97C,102C 'test-ib':35B 'vulner':85C 'wast':62B 'without':45B,133C 'workstat':27B 'write':121C,125C,162C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the amdgpu driver for AMD GPUs, where the debugfs test-IB interface is present. The sources do not describe a trigger that a non-root user can reach, so machines without AMD GPUs or without the amdgpu driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98519","severity":null,"published_at":"2026-10-18T16:17:03+00:00","modified_at":"2026-10-19T10:19:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}