Live › vulnerability › CVE-2026-99149
Go to dashboardWhen the AMD GPU driver's userptr ioctl runs out of memory, it returns early and skips cleanup, leaving a GEM object, a VM root reference and an MMU notifier registration behind. The practical effect is a resource leak in the kernel driver, which can degrade a system under memory pressure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the amdgpu driver loaded and the vulnerable userptr code path present, typically workstations and servers with AMD GPUs using ROCm or graphics userptr buffers. Systems without AMD GPUs or without amdgpu loaded are not affected. The sources do not say how an attacker would trigger the leak.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind.
Use release_object here, not user_pages_done, range is still NULL at this point.
(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)
This page as .md · .json · in your agent: get_signal("CVE-2026-99149")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.