{"id":"CVE-2026-98949","kind":"vulnerability","aliases":["CVE-2026-98949"],"related":[],"title":"Linux kernel: PowerVR driver leaks GEM references and misLinks mappings on remap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix reference and vm_bo handling in remap()\n\nWhen a map overlaps part of an existing mapping, pvr_vm_gpuva_remap()\nsplits the mapping into prev/next parts covering what the request did\nnot take, instead of creating something new. It gets two things wrong.\n\n- A GEM reference is taken for each part but it's never needed and never\n  dropped, so it leaks one reference per split (remap-next-in-2m in\n  tests/imagination/pvr_vm_map.c):\n\n    CRITICAL: 33558528 bytes of shmem still held after close\n\n- The parts still belong to the original object being split, but\n  pvr_vm_gpuva_remap() links them to ctx->gpuvm_bo, the new object's\n  vm_bo:\n\n    prev_va --obj--> BO_A          BO_B <--obj-- vm_bo (ctx->gpuvm_bo)\n            \\___________link___________/  (mismatch: BO_A != BO_B)\n\n  drm_gpuva_link() catches the mismatch:\n\n    WARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310\n      drm_WARN_ON(obj != vm_bo->obj)\n    Call trace:\n     drm_gpuva_link\n     pvr_vm_gpuva_remap\n     __drm_gpuvm_sm_map\n     pvr_vm_map\n     pvr_ioctl_vm_map\n\n  Link them to op->remap.unmap->va->vm_bo instead.\n\nThe locking of the GPUVA lists of the other objects touched by a split is\nnot addressed here; it is handled by switching the GPUVM to immediate\nmode.","summary":"The Linux kernel's Imagination PowerVR DRM driver takes a GEM reference on each split part of a GPU mapping and never drops it, leaking memory. It also links the split parts to the wrong buffer object's VM record, which triggers a kernel warning.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","imagination-gpu","linux-kernel","package","powervr"],"not_affected_if":["no-powervr-gpu"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:16+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:55+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:57:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: PowerVR driver leaks GEM references and misLinks mappings on remap","impact":"low","summary":"The Linux kernel's Imagination PowerVR DRM driver takes a GEM reference on each split part of a GPU mapping and never drops it, leaking memory. It also links the split parts to the wrong buffer object's VM record, which triggers a kernel warning.","category":"package","nicknames":[],"who_cares":["linux-kernel","drm","powervr","imagination-gpu"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory leak and kernel warning, possible denial of service","analyst_note":"Find the fixed kernel versions and stable backport commit for the drm/imagination remap fix, and check whether the ioctl can be reached by unprivileged local users.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-powervr-gpu"],"who_is_affected":"Systems running a Linux kernel with the Imagination PowerVR DRM driver (drm/imagination) in use, typically devices with PowerVR GPUs. The sources do not say which kernel versions are fixed, and they do not describe an attacker-reachable path beyond the driver's ioctl.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000623,"input_tokens":3807,"output_tokens":485,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':226C '-2026':14A,17A '-98949':15A,18A '2108':221C '2m':155C '33558528':159C 'address':280C 'also':55B 'b':200C,212C 'belong':170C 'bo':88C,187C,193C,197C,199C,203C,206C,209C,211C,233C,262C 'buffer':63B 'byte':160C 'call':235C 'catch':216C 'close':166C 'cover':111C 'creat':120C 'critic':158C 'ctx':185C,204C 'cve':13A,16A 'driver':4A,35B 'drivers/gpu/drm/drm_gpuvm.c':220C 'drm':19B,34B,213C,223C,228C,237C,244C 'drm/imagination':83C 'drop':50B,143C 'exist':99C 'fix':84C 'follow':78C 'gem':6A,38B,129C 'get':124C 'gpu':22B,46B 'gpuva':103C,180C,214C,224C,238C,242C,268C 'gpuvm':186C,205C,245C,288C 'handl':89C,284C 'held':164C 'imagin':21B,32B 'imagination-gpu':20B 'immedi':290C 'instead':118C,263C 'ioctl':252C 'kernel':2A,25B,30B,71B,76C 'leak':5A,52B,146C 'link':56B,182C,207C,215C,225C,239C,255C 'linux':1A,24B,29B,75C 'linux-kernel':23B 'list':269C 'lock':265C 'map':10A,47B,94C,100C,107C,247C,250C,254C 'memori':53B 'mislink':9A 'mismatch':208C,218C 'mode':291C 'need':140C 'never':49B,139C,142C 'new':122C,189C 'next':153C 'obj':196C,201C,231C,234C 'object':64B,174C,190C,273C 'one':147C 'op':258C 'origin':173C 'overlap':95C 'packag':26B 'part':43B,59B,96C,110C,135C,168C 'per':149C 'powervr':3A,27B,33B 'prev':194C 'prev/next':109C 'pvr':101C,178C,240C,248C,251C 'record':67B 'refer':7A,39B,85C,130C,148C 'remap':12A,91C,104C,152C,181C,243C 'remap-next-in-2m':151C 'remap.unmap':259C 'request':114C 'resolv':82C 'shmem':162C 'sm':246C 'someth':121C 'split':42B,58B,105C,150C,176C,277C 'still':163C,169C 'switch':286C 'take':36B,117C 'taken':132C 'tests/imagination/pvr_vm_map.c':157C 'thing':126C 'touch':274C 'trace':236C 'trigger':69B 'two':125C 'va':195C,260C 'vm':66B,87C,102C,179C,192C,202C,232C,241C,249C,253C,261C 'vulner':79C 'warn':72B,219C,229C 'wrong':62B,127C 'x2ec/0x310':227C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Imagination PowerVR DRM driver (drm/imagination) in use, typically devices with PowerVR GPUs. The sources do not say which kernel versions are fixed, and they do not describe an attacker-reachable path beyond the driver's ioctl.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98949","severity":null,"published_at":"2026-10-23T13:17:16+00:00","modified_at":"2026-10-23T13:17:16+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98949","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98949","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}