drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure radeon_ring_restore() takes ownership of the data buffer allocated by radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in the non-restore branch; in the restore branch it relies on radeon_ring_restore() to free it. If radeon_ring_lock() fails, the function returned early without calling kvfree(data), leaking the ring backup buffer on every GPU reset that fails at the lock stage. During repeated GPU resets this causes cumulative kernel memory exhaustion. Free data before returning the error.
References
- https://git.kernel.org/stable/c/63912418f1fbb6456ea04bbcdf8f4d5090d23350
- https://git.kernel.org/stable/c/919e3e398bf301c6418dffdcd5e5c4fd9be39cf7
- https://git.kernel.org/stable/c/07c213f3499dd72e2922c1c73fe9ffea24874bef
- https://git.kernel.org/stable/c/1c9ba32308c02c198c378fcdf06be9ffc3111147
- https://git.kernel.org/stable/c/eecfb76129ebef7e3aa41e18a4668cd91dfc6267
- https://git.kernel.org/stable/c/06dc892561f5a08b2493c34c8ec2cb94dea33159
- https://git.kernel.org/stable/c/ccc42187fc2d0720947a63ce1b9e399d2c068ff4
- https://git.kernel.org/stable/c/82f1d6042611d45b8b9de423bbcb4e0ced9ec62b
European references
- ENISA EUVD · EUVD-2026-59563
- GCVE · GCVE-0-2026-74416
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1231 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 55d7c22192becd0ec827a6901899ff56fa985658 < 63912418f1fbb6456ea04bbcdf8f4d5090d23350 ; affected 55d7c22192becd0ec827a6901899ff56fa985658 < 919e3e398bf301c6418dffdcd5e5c4fd9be39cf7 ; affected 55d7c22192becd0ec827a6901899ff56fa985658 < 07c213f3499dd72e2922c1c73fe9ffea24874bef ; affected 55d7c22192becd0ec827a6901899ff56fa985658 < 1c9ba32308c02c198c378fcdf06be9ffc3111147 ; affected 55d7c22192becd0ec827a6901899ff56fa985658 < eecfb76129ebef7e3aa41e18a4668cd91dfc6267 ; affected 55d7c22192becd0ec827a6901899ff56fa985658 < 06dc892561f5a08b2493c34c8ec2cb94dea33159 |
| Linux · Linux | affected 3.6 ; unaffected 0 < 3.6 ; unaffected 5.10.261 ≤ 5.10.* ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |