---
id: CVE-2026-99149
title: 'drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

  When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns
  -ENOMEM right away and skips the clea…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e095b55155ef69a8ae0eb114a7fd2a381c012f33 <
    64a6d40156ae98caafc922c6d79fe202b0acd836
  - >-
    Linux >= e095b55155ef69a8ae0eb114a7fd2a381c012f33 <
    3c516a5646285442e1cd71dff2584b77eb4fc421
  - Linux 6.19
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:05.015Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99149'
references:
  - url: 'https://git.kernel.org/stable/c/64a6d40156ae98caafc922c6d79fe202b0acd836'
  - url: 'https://git.kernel.org/stable/c/3c516a5646285442e1cd71dff2584b77eb4fc421'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.409Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns
-ENOMEM right away and skips the cleanup every other error path goes
through. The GEM object, the bo->parent reference on the VM root and the
MMU notifier registration are all left behind.

Use release_object here, not user_pages_done, range is still NULL at
this point.

(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)

## Affected

- `Linux >= e095b55155ef69a8ae0eb114a7fd2a381c012f33 < 64a6d40156ae98caafc922c6d79fe202b0acd836`
- `Linux >= e095b55155ef69a8ae0eb114a7fd2a381c012f33 < 3c516a5646285442e1cd71dff2584b77eb4fc421`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.