{"id":"CVE-2026-99150","kind":"vulnerability","aliases":["CVE-2026-99150"],"related":[],"title":"Linux amdgpu: debugfs GPR read drops runtime PM reference twice","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr\n\namdgpu_debugfs_gpr_read() drops its runtime PM reference right after\nreading the wave registers. When copying them to userspace fails, it\njumps to the err label, which drops the reference a second time. A read\ninto a bad buffer on Navi31 either steals a reference somebody else\nholds (power/runtime_usage goes from 1 to 0) or underflows the count:\n\n  amdgpu 0000:03:00.0: Runtime PM usage count underflow!\n\nThe registers are already in the kernel buffer at that point, so finish\nthe hardware access first and copy the buffer with a single\ncopy_to_user() instead of the put_user() loop with its own error path.\n\n(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)","summary":"In the amdgpu driver's GPR debugfs read path, a failed copy to userspace drops the runtime power-management reference a second time, which corrupts the usage count. The sources describe a refcount underflow or stolen reference on Navi31 GPUs, with no stated attacker capability.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amdgpu","linux","navi31","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:35:56+00:00","updated_at":"2026-10-28T11:35:56+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:35:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux amdgpu: debugfs GPR read drops runtime PM reference twice","impact":"low","summary":"In the amdgpu driver's GPR debugfs read path, a failed copy to userspace drops the runtime power-management reference a second time, which corrupts the usage count. The sources describe a refcount underflow or stolen reference on Navi31 GPUs, with no stated attacker capability.","category":"runtime","nicknames":[],"who_cares":["linux","amdgpu","navi31"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm the fixed kernel version and whether the debugfs path needs root; check the upstream commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a for the affected stable ranges.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000542,"input_tokens":3529,"output_tokens":378,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99150':13A,16A '0':143C '00.0':151C '0000':149C '03':150C '1':141C '31035bbd74f7c3e10c163db875b8e67f8b50ee6a':199C 'access':172C 'alreadi':160C 'amdgpu':2A,17B,23B,87C,89C,148C 'attack':65B 'bad':127C 'buffer':128C,164C,177C 'capabl':66B 'cherri':195C 'commit':198C 'copi':32B,105C,175C,181C 'corrupt':46B 'count':49B,147C,155C 'cve':11A,14A 'debugf':3A,27B,90C 'describ':52B 'driver':24B 'drm/amdgpu':77C 'drop':6A,35B,80C,93C,117C 'either':131C 'els':136C 'err':114C 'error':193C 'fail':31B,109C 'finish':169C 'first':173C 'follow':72C 'goe':139C 'gpr':4A,26B,88C,91C 'gpus':61B 'hardwar':171C 'hold':137C 'instead':184C 'jump':111C 'kernel':70C,163C 'label':115C 'linux':1A,18B,69C 'loop':189C 'manag':40B 'navi31':19B,60B,130C 'path':29B,194C 'pick':196C 'pm':8A,83C,96C,153C 'point':167C 'power':39B 'power-manag':38B 'power/runtime_usage':138C 'put':187C 'read':5A,28B,92C,100C,124C 'refcount':54B 'refer':9A,41B,58B,84C,97C,119C,134C 'regist':103C,158C 'resolv':76C 'right':98C 'runtim':7A,20B,37B,82C,95C,152C 'second':43B,121C 'singl':180C 'somebodi':135C 'sourc':51B 'state':64B 'steal':132C 'stolen':57B 'time':44B,122C 'twice':10A,85C 'underflow':55B,145C,156C 'usag':48B,154C 'user':183C,188C 'userspac':34B,108C 'vulner':73C 'wave':102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99150","severity":null,"published_at":"2026-10-28T11:17:35+00:00","modified_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}