{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74416","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.893Z","datePublished":"2026-08-15T05:59:22.077Z","dateUpdated":"2026-08-17T05:18:58.660Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:18:58.660Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix memory leak in radeon_ring_restore() on lock failure\n\nradeon_ring_restore() takes ownership of the data buffer allocated by\nradeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in\nthe non-restore branch; in the restore branch it relies on\nradeon_ring_restore() to free it.\n\nIf radeon_ring_lock() fails, the function returned early without calling\nkvfree(data), leaking the ring backup buffer on every GPU reset that\nfails at the lock stage. During repeated GPU resets this causes\ncumulative kernel memory exhaustion.\n\nFree data before returning the error."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/radeon/radeon_ring.c"],"versions":[{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"63912418f1fbb6456ea04bbcdf8f4d5090d23350","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"919e3e398bf301c6418dffdcd5e5c4fd9be39cf7","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"07c213f3499dd72e2922c1c73fe9ffea24874bef","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"1c9ba32308c02c198c378fcdf06be9ffc3111147","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"eecfb76129ebef7e3aa41e18a4668cd91dfc6267","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"06dc892561f5a08b2493c34c8ec2cb94dea33159","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"ccc42187fc2d0720947a63ce1b9e399d2c068ff4","status":"affected","versionType":"git"},{"version":"55d7c22192becd0ec827a6901899ff56fa985658","lessThan":"82f1d6042611d45b8b9de423bbcb4e0ced9ec62b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/radeon/radeon_ring.c"],"versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","status":"unaffected","versionType":"semver"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/63912418f1fbb6456ea04bbcdf8f4d5090d23350"},{"url":"https://git.kernel.org/stable/c/919e3e398bf301c6418dffdcd5e5c4fd9be39cf7"},{"url":"https://git.kernel.org/stable/c/07c213f3499dd72e2922c1c73fe9ffea24874bef"},{"url":"https://git.kernel.org/stable/c/1c9ba32308c02c198c378fcdf06be9ffc3111147"},{"url":"https://git.kernel.org/stable/c/eecfb76129ebef7e3aa41e18a4668cd91dfc6267"},{"url":"https://git.kernel.org/stable/c/06dc892561f5a08b2493c34c8ec2cb94dea33159"},{"url":"https://git.kernel.org/stable/c/ccc42187fc2d0720947a63ce1b9e399d2c068ff4"},{"url":"https://git.kernel.org/stable/c/82f1d6042611d45b8b9de423bbcb4e0ced9ec62b"}],"title":"drm/radeon: fix memory leak in radeon_ring_restore() on lock failure","x_generator":{"engine":"bippy-1.2.0"}}}}