All vulnerabilities
CVE-2026-98997

Linux: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in112dbe2b10d6d088a6c599980dd960dcbfa55ff0Also 8640b3f961d743d6dc0458c2b53a3af434690cc1, 7f7c88dbf4d543f6703e53bdeed380e886733167CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 112dbe2b10d6d088a6c599980dd960dcbfa55ff0LinuxCVE List
  • 8640b3f961d743d6dc0458c2b53a3af434690cc1LinuxCVE List
  • 7f7c88dbf4d543f6703e53bdeed380e886733167LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents are lost. Since an importer on the same device gets the exporter's GEM object, a client can do this to a buffer another client shared with it.

Reject BOs that were not created in the doorbell domain.

v2: drop the error message, use a local abo variable (Christian)

(cherry picked from commit f7497bbc19db4821c62b9d97b31c9086feb2d917)

Text from CVE List

Affected versions 8

  • Linuxaffected: f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 before 112dbe2b10d6d088a6c599980dd960dcbfa55ff0CVE List
  • Linuxaffected: f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 before 8640b3f961d743d6dc0458c2b53a3af434690cc1CVE List
  • Linuxaffected: f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 before 7f7c88dbf4d543f6703e53bdeed380e886733167CVE List
  • Linuxaffected: 6.16CVE List
  • Linuxunaffected: all versions before 6.16CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3