---
id: CVE-2026-74416
title: 'drm/radeon: fix memory leak in radeon_ring_restore() on lock failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

  radeon_ring_restore() takes ownership of the data buffer allocated by
  radeon_ring_backup(). The ca…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    63912418f1fbb6456ea04bbcdf8f4d5090d23350
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    919e3e398bf301c6418dffdcd5e5c4fd9be39cf7
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    07c213f3499dd72e2922c1c73fe9ffea24874bef
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    1c9ba32308c02c198c378fcdf06be9ffc3111147
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    eecfb76129ebef7e3aa41e18a4668cd91dfc6267
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    06dc892561f5a08b2493c34c8ec2cb94dea33159
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    ccc42187fc2d0720947a63ce1b9e399d2c068ff4
  - >-
    Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 <
    82f1d6042611d45b8b9de423bbcb4e0ced9ec62b
  - Linux 3.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:57:10.933901Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:45.592Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74416'
references:
  - url: 'https://git.kernel.org/stable/c/63912418f1fbb6456ea04bbcdf8f4d5090d23350'
  - url: 'https://git.kernel.org/stable/c/919e3e398bf301c6418dffdcd5e5c4fd9be39cf7'
  - url: 'https://git.kernel.org/stable/c/07c213f3499dd72e2922c1c73fe9ffea24874bef'
  - url: 'https://git.kernel.org/stable/c/1c9ba32308c02c198c378fcdf06be9ffc3111147'
  - url: 'https://git.kernel.org/stable/c/eecfb76129ebef7e3aa41e18a4668cd91dfc6267'
  - url: 'https://git.kernel.org/stable/c/06dc892561f5a08b2493c34c8ec2cb94dea33159'
  - url: 'https://git.kernel.org/stable/c/ccc42187fc2d0720947a63ce1b9e399d2c068ff4'
  - url: 'https://git.kernel.org/stable/c/82f1d6042611d45b8b9de423bbcb4e0ced9ec62b'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12538
ingestedAt: '2026-11-06T18:00:12.561Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

radeon_ring_restore() takes ownership of the data buffer allocated by
radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
the non-restore branch; in the restore branch it relies on
radeon_ring_restore() to free it.

If radeon_ring_lock() fails, the function returned early without calling
kvfree(data), leaking the ring backup buffer on every GPU reset that
fails at the lock stage. During repeated GPU resets this causes
cumulative kernel memory exhaustion.

Free data before returning the error.

## Affected

- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < 63912418f1fbb6456ea04bbcdf8f4d5090d23350`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < 919e3e398bf301c6418dffdcd5e5c4fd9be39cf7`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < 07c213f3499dd72e2922c1c73fe9ffea24874bef`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < 1c9ba32308c02c198c378fcdf06be9ffc3111147`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < eecfb76129ebef7e3aa41e18a4668cd91dfc6267`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < 06dc892561f5a08b2493c34c8ec2cb94dea33159`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < ccc42187fc2d0720947a63ce1b9e399d2c068ff4`
- `Linux >= 55d7c22192becd0ec827a6901899ff56fa985658 < 82f1d6042611d45b8b9de423bbcb4e0ced9ec62b`
- `Linux 3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.