---
id: "CVE-2026-98519"
kind: "vulnerability"
aliases: ["CVE-2026-98519"]
title: "Linux amdgpu driver leaks a GPU power reference on interrupted debugfs read"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["amd-gpu", "amdgpu", "linux-kernel", "runtime", "workstations"]
not_affected_if: ["amdgpu-not-loaded", "no-amd-gpu"]
published_at: "2026-10-18T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98519", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux amdgpu driver leaks a GPU power reference on interrupted debugfs read

In the amdgpu graphics driver's debugfs test-IB show routine, an interrupted lock acquisition returns without dropping the runtime PM reference taken for the device. The GPU is then kept awake, which wastes power and blocks suspend, with no sign that an attacker gains code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and check whether the running kernel includes the upstream commit ec30a576c2d4c0364549e6c04218f50704ef56c8 or a stable backport of it
- unknown

## Fix

- Update the Linux kernel to a stable release that includes the backport of commit ec30a576c2d4c0364549e6c04218f50704ef56c8
- unknown

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98519

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

amdgpu_debugfs_test_ib_show() resumes the device with
pm_runtime_get_sync() before taking the reset domain semaphore with
down_write_killable().  If the write lock acquisition is interrupted,
the function returns without calling pm_runtime_put_autosuspend(),
leaking the runtime PM reference acquired for the device and keeping
the GPU awake.

Drop the runtime PM reference on the interrupted down_write_killable()
error path before returning.

(cherry picked from commit ec30a576c2d4c0364549e6c04218f50704ef56c8)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_