{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63880","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.018Z","datePublished":"2026-07-19T14:54:52.397Z","dateUpdated":"2026-07-19T14:54:52.397Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-07-19T14:54:52.397Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO\n\nThe AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl()\nholds three cleanup-tracked resources before calling kvcalloc():\nthe drm_gem_object reference from drm_gem_object_lookup(), the\ndrm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and\nthe drm_exec lock on the per-process VM root page directory via\namdgpu_vm_lock_pd().  All three are released by the out_exec\nlabel that every other error path in this function jumps to.\nThe kvcalloc() failure path returns -ENOMEM directly, skipping\nout_exec and leaking all three.\n\nThe leaked per-process VM root PD dma_resv lock is the\nload-bearing leak: any subsequent operation on the same VM\n(further GEM ops, command-submission, eviction, TTM shrinker\ncallbacks) blocks on the held lock.  DRM_IOCTL_AMDGPU_GEM_OP is\nDRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local\ndenial of service against the caller's GPU context, reachable\nby any process with /dev/dri/renderD* access.\n\nRoute the failure through out_exec so drm_exec_fini() and\ndrm_gem_object_put() run.\n\nReproduced on stock 7.0.0-10, Ryzen 7 5700U / Radeon Vega\n(Lucienne): the failing ioctl returns -ENOMEM and a second\nGET_MAPPING_INFO on the same fd then blocks in\ndrm_exec_lock_obj() on the leaked dma_resv.  SIGKILL on the\ncaller does not reap the task; the fd-release path during\nprocess exit goes through amdgpu_gem_object_close() ->\ndrm_exec_prepare_obj() on the same lock, leaving the task in D\nstate until the box is rebooted.  The patched kernel was not\nrebuilt and re-tested on this hardware; the fix is mechanical.\nTested on a single Lucienne / Vega box only.\n\nZiyi Guo posted an independent INT_MAX-bound check for\nargs->num_entries in the same branch [1]; the two patches are\ncomplementary and can land in either order.\n\n(cherry picked from commit b69d3256d79de15f54c322986ff4da68f1d65b0a)"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"],"versions":[{"version":"4d82724f7f2b847eb0454b1aab5450545b39abd4","lessThan":"1eb86334e391695d4a40743b114afc15df4dc506","status":"affected","versionType":"git"},{"version":"4d82724f7f2b847eb0454b1aab5450545b39abd4","lessThan":"8f643d534ffc6f1b6182e4f3acff8f04890504b9","status":"affected","versionType":"git"},{"version":"4d82724f7f2b847eb0454b1aab5450545b39abd4","lessThan":"2e7f55eb408c3f72ee1957a0d0ad11d8648a6379","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"],"versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1eb86334e391695d4a40743b114afc15df4dc506"},{"url":"https://git.kernel.org/stable/c/8f643d534ffc6f1b6182e4f3acff8f04890504b9"},{"url":"https://git.kernel.org/stable/c/2e7f55eb408c3f72ee1957a0d0ad11d8648a6379"}],"title":"drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO","x_generator":{"engine":"bippy-1.2.0"}}}}