CVE-2022-49137

drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: Aug 12, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj

This issue takes place in an error path in amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into default case, the function simply returns -EINVAL, forgetting to decrement the reference count of a dma_fence obj, which is bumped earlier by amdgpu_cs_get_fence(). This may result in reference count leaks.

Fix it by decreasing the refcount of specific object before returning the error code.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 72d77ddb2224ebc00648f4f78f8a9a259dccbdf7Affected 7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 4009f104b02b223d1a11d74b36b1cc083bc37028Affected 7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 927beb05aaa429c883cc0ec6adc48964b187e291Affected 7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 3edd8646cb7c11b57c90e026bda6f21076223f5bAffected 7ca24cf2d2269bde25e21c02a77fe81995a081ae to before b6d1f7d97c81ebaf2cda9c4c943ee2e484fffdcfAffected 7ca24cf2d2269bde25e21c02a77fe81995a081ae to before bc2d5c0775c839e2b072884f4ee6a93ba410f107Affected 7ca24cf2d2269bde25e21c02a77fe81995a081ae to before dfced44f122c500004a48ecc8db516bb6a295a1bAffected
LinuxLinux	4.15Affected before 4.15Not affected 4.19.238 through 4.19.Not affected 5.4.189 through 5.4.Not affected 5.10.111 through 5.10.Not affected 5.15.34 through 5.15.Not affected 5.16.20 through 5.16.Not affected 5.17.3 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 72d77ddb2224ebc00648f4f78f8a9a259dccbdf7Affected
7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 4009f104b02b223d1a11d74b36b1cc083bc37028Affected
7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 927beb05aaa429c883cc0ec6adc48964b187e291Affected
7ca24cf2d2269bde25e21c02a77fe81995a081ae to before 3edd8646cb7c11b57c90e026bda6f21076223f5bAffected
7ca24cf2d2269bde25e21c02a77fe81995a081ae to before b6d1f7d97c81ebaf2cda9c4c943ee2e484fffdcfAffected
7ca24cf2d2269bde25e21c02a77fe81995a081ae to before bc2d5c0775c839e2b072884f4ee6a93ba410f107Affected
7ca24cf2d2269bde25e21c02a77fe81995a081ae to before dfced44f122c500004a48ecc8db516bb6a295a1bAffected

LinuxLinux

4.15Affected
before 4.15Not affected
4.19.238 through 4.19.*Not affected
5.4.189 through 5.4.*Not affected
5.10.111 through 5.10.*Not affected
5.15.34 through 5.15.*Not affected
5.16.20 through 5.16.*Not affected
5.17.3 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.