Riskcovery

CVE-2026-98997

drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 23, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents are lost. Since an importer on the same device gets the exporter's GEM object, a client can do this to a buffer another client shared with it.

Reject BOs that were not created in the doorbell domain.

v2: drop the error message, use a local abo variable (Christian)

(cherry picked from commit f7497bbc19db4821c62b9d97b31c9086feb2d917)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to before 112dbe2b10d6d088a6c599980dd960dcbfa55ff0Affected
  • f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to before 8640b3f961d743d6dc0458c2b53a3af434690cc1Affected
  • f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to before 7f7c88dbf4d543f6703e53bdeed380e886733167Affected
LinuxLinux
  • 6.16Affected
  • before 6.16Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.