All vulnerabilities
CVE-2026-99150

Linux: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in652b1f26125fe48aed5f4944698a85b457eef491Also 253555a9baccefffe1f6e5f2fe54363c7c01ebb9, 5.9CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 652b1f26125fe48aed5f4944698a85b457eef491LinuxCVE List
  • 253555a9baccefffe1f6e5f2fe54363c7c01ebb9LinuxCVE List
  • 5.9LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count:

amdgpu 0000:03:00.0: Runtime PM usage count underflow!

The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path.

(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)

Text from CVE List

Affected versions 10

  • Linuxaffected: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 before 652b1f26125fe48aed5f4944698a85b457eef491CVE List
  • Linuxaffected: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 before 253555a9baccefffe1f6e5f2fe54363c7c01ebb9CVE List
  • Linuxaffected: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 before de9f6bcdb44f0e410031002e2f103826ea6b6259CVE List
  • Linuxaffected: 865e2dbadf6856c9219626fbd6154cac44e5fbcaCVE List
  • Linuxaffected: 5.8.2 before 5.9CVE List
  • Linuxaffected: 5.9CVE List
  • Linuxunaffected: all versions before 5.9CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3