All vulnerabilities
CVE-2026-98780

Linux: drm/amdgpu: fix IP instance memory leak on kobject add failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0563b26c1437fe7e25ea42c334eb85c0a703f8ffAlso 7ca44cb14d0249992a8f1425ba004d6e2d16d255CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0563b26c1437fe7e25ea42c334eb85c0a703f8ffLinuxCVE List
  • 7ca44cb14d0249992a8f1425ba004d6e2d16d255LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix IP instance memory leak on kobject add failure

amdgpu_discovery_sysfs_ips() allocates ip_hw_instance with kzalloc_flex() and initializes its embedded kobject before calling kobject_add().

If kobject_add() fails, the return value is ignored and execution continues without dropping the initial kobject reference. The failed kobject is not retained in the kset list, so the normal sysfs teardown path cannot find it. As a result, ip_hw_instance_release() is never called and the ip_hw_instance allocation is leaked.

Call kobject_put() when kobject_add() fails so the initial reference is dropped and ip_hw_instance_release() can free the allocation. Keep the existing best-effort sysfs behavior by continuing with the remaining IP entries after the failed registration.

The issue was identified by a static analysis tool I developed and confirmed by manual review.

(cherry picked from commit 5c75fbcca8af1096d8d9415b91d8ea6212c22ee1)

Text from CVE List

Affected versions 12

  • Linuxaffected: a6c40b178092f41b9d6cc8615697c14b1e5a1c3a before f6364e7284a131556f5d763d867147bece2843a8CVE List
  • Linuxaffected: a6c40b178092f41b9d6cc8615697c14b1e5a1c3a before 0563b26c1437fe7e25ea42c334eb85c0a703f8ffCVE List
  • Linuxaffected: a6c40b178092f41b9d6cc8615697c14b1e5a1c3a before 7ca44cb14d0249992a8f1425ba004d6e2d16d255CVE List
  • Linuxaffected: a6c40b178092f41b9d6cc8615697c14b1e5a1c3a before c05bbcc263d67b8b158e2a52be7e3005895969d1CVE List
  • Linuxaffected: a6c40b178092f41b9d6cc8615697c14b1e5a1c3a before f5a5add3605935163dd0f75749b6a7869e9765afCVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5