---
id: CVE-2026-68234
title: 'drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

  amdgpu_bo_create_reserved() only allocates a new BO when
  *bo_ptr (struct amdgpu_bo **bo_ptr as input param…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    7aea619d9f186dcf0f1289879e9edb69d2b56639
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    b572d0814c1366701ca704286589fab025802566
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    e06e0885725a16304b7723aeb478a78cca9dc96a
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    51eeef1949c11d3dcb5f422a5d9b3f09ebe8a1bc
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    2f390b4c83011452753fd84972f657d2b00a952b
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    ba7b6444097a73ccd3d3ac9e2be4ebb73d226460
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    9743f60013273987abf415dc47474683d22aaee9
  - >-
    Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 <
    a2f895f3c852063258d62e9f74b081de07ca95df
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:45:23.989431Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:10.311Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68234'
references:
  - url: 'https://git.kernel.org/stable/c/7aea619d9f186dcf0f1289879e9edb69d2b56639'
  - url: 'https://git.kernel.org/stable/c/b572d0814c1366701ca704286589fab025802566'
  - url: 'https://git.kernel.org/stable/c/e06e0885725a16304b7723aeb478a78cca9dc96a'
  - url: 'https://git.kernel.org/stable/c/51eeef1949c11d3dcb5f422a5d9b3f09ebe8a1bc'
  - url: 'https://git.kernel.org/stable/c/2f390b4c83011452753fd84972f657d2b00a952b'
  - url: 'https://git.kernel.org/stable/c/ba7b6444097a73ccd3d3ac9e2be4ebb73d226460'
  - url: 'https://git.kernel.org/stable/c/9743f60013273987abf415dc47474683d22aaee9'
  - url: 'https://git.kernel.org/stable/c/a2f895f3c852063258d62e9f74b081de07ca95df'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.0724
ingestedAt: '2026-11-06T18:00:12.617Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

amdgpu_bo_create_reserved() only allocates a new BO when
*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
NULL, it simply skips creation when *bo_ptr is non-NULL.
But it unconditionally reserves, pins, gart allocates
and maps the BO afterwards.

When the same non-NULL BO pointer is passed in again,
for example firmware buffers that live in adev and are
re-loaded on every resume / cp_resume / start
under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
pin_count unconditionally, however the matching teardown only unpins
once, so pin_count never drops to zero, so TTM is not able
to move, swap or evict a BO, causing BO leaks.

This commit fixes this issue by only pinning the bo
once at creation, and repeated calls no longer
take additional pin references.

(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)

## Affected

- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < 7aea619d9f186dcf0f1289879e9edb69d2b56639`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < b572d0814c1366701ca704286589fab025802566`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < e06e0885725a16304b7723aeb478a78cca9dc96a`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < 51eeef1949c11d3dcb5f422a5d9b3f09ebe8a1bc`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < 2f390b4c83011452753fd84972f657d2b00a952b`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < ba7b6444097a73ccd3d3ac9e2be4ebb73d226460`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < 9743f60013273987abf415dc47474683d22aaee9`
- `Linux >= 53766e5adac75872e9d413cdbfd0e47ae40701f9 < a2f895f3c852063258d62e9f74b081de07ca95df`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.