---
id: CVE-2026-99106
title: 'drm/amdgpu: free the userptr ranges when a CS fails after parser_bos'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

  amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of
  the BO list and looks up …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 <
    e265221019d20fa162b62baec16c44b5b2ea295b
  - >-
    Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 <
    79179efd1ad4729cf0ff9e15eb9414f883e4aec2
  - >-
    Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 <
    6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a
  - >-
    Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 <
    2d9d24385201f476a2f754495b71bbac5ba6ea7b
  - >-
    Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 <
    1b4da805a0ba354a549ce07459c871c17dd94fe0
  - Linux 6.2
published: '2026-10-28'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:41:47.227Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99106'
references:
  - url: 'https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b'
  - url: 'https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2'
  - url: 'https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a'
  - url: 'https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b'
  - url: 'https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.07143
ingestedAt: '2026-10-28T11:09:40.457Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: free the userptr ranges when a CS fails after parser_bos

amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of
the BO list and looks up the user pages. Those ranges are only freed when
amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks
them under the notifier lock. If amdgpu_cs_patch_jobs(),
amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of
amdgpu_cs_submit() fails, nothing frees them: neither
amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.

Each such CS then leaks the range, its hmm_pfns array (8 bytes per page
of the userptr BO) and the BO reference the range holds. An IB on a ring
that patches the CS in place (e.g. VCN) with an unmapped va_start fails
in amdgpu_cs_patch_ibs() and takes this path.

Free the ranges on those error paths. Ranges amdgpu_cs_submit() already
dropped are NULL, so freeing them again is a no-op.

(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)

## Affected

- `Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 < e265221019d20fa162b62baec16c44b5b2ea295b`
- `Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 < 79179efd1ad4729cf0ff9e15eb9414f883e4aec2`
- `Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 < 6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a`
- `Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 < 2d9d24385201f476a2f754495b71bbac5ba6ea7b`
- `Linux >= fec8fdb54e8f74d88951c9f998f47bf4f2031fe0 < 1b4da805a0ba354a549ce07459c871c17dd94fe0`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.