{"id":"CVE-2026-99150","summary":"drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr\n\namdgpu_debugfs_gpr_read() drops its runtime PM reference right after\nreading the wave registers. When copying them to userspace fails, it\njumps to the err label, which drops the reference a second time. A read\ninto a bad buffer on Navi31 either steals a reference somebody else\nholds (power/runtime_usage goes from 1 to 0) or underflows the count:\n\n  amdgpu 0000:03:00.0: Runtime PM usage count underflow!\n\nThe registers are already in the kernel buffer at that point, so finish\nthe hardware access first and copy the buffer with a single\ncopy_to_user() instead of the put_user() loop with its own error path.\n\n(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)","modified":"2026-11-13T04:07:33.604955815Z","published":"2026-10-28T10:35:05.753Z","related":["SUSE-SU-2026:24550-1","SUSE-SU-2026:24619-1","SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99150.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/24c1f6e381d564e5f6893323cfe0264950358451"},{"type":"WEB","url":"https://git.kernel.org/stable/c/253555a9baccefffe1f6e5f2fe54363c7c01ebb9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/35aa048f242cade635f17924183c1df0ffe7a486"},{"type":"WEB","url":"https://git.kernel.org/stable/c/652b1f26125fe48aed5f4944698a85b457eef491"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c333834b1b9cbb1021c954d29fa2373ac9e73499"},{"type":"WEB","url":"https://git.kernel.org/stable/c/de9f6bcdb44f0e410031002e2f103826ea6b6259"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eda6b57a83d942199a5947e73556fe918affad86"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f9c0b333a5e44f734478ca8a7345f8b87d65ba7c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99150.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99150"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9eee152aab56d374edb9ad21b3db05f5cdda2fe6"},{"fixed":"24c1f6e381d564e5f6893323cfe0264950358451"},{"fixed":"c333834b1b9cbb1021c954d29fa2373ac9e73499"},{"fixed":"eda6b57a83d942199a5947e73556fe918affad86"},{"fixed":"f9c0b333a5e44f734478ca8a7345f8b87d65ba7c"},{"fixed":"35aa048f242cade635f17924183c1df0ffe7a486"},{"fixed":"652b1f26125fe48aed5f4944698a85b457eef491"},{"fixed":"253555a9baccefffe1f6e5f2fe54363c7c01ebb9"},{"fixed":"de9f6bcdb44f0e410031002e2f103826ea6b6259"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"865e2dbadf6856c9219626fbd6154cac44e5fbca"}]}],"versions":["v5.8.18","v5.8.17","v5.8.16","v5.8.15","v5.8.14","v5.8.13","v5.8.12","v5.8.11","v5.8.10","v5.8.9","v5.8.8","v5.8.7","v5.8.6","v5.8.5","v5.8.4","v5.8.3","v5.8.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99150.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.2"},{"fixed":"5.9"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"5.10.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.224"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.161"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.115"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.59"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99150.json"}}],"schema_version":"1.9.2"}