https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 10:44:16 +0000 https://db.gcve.eu/vuln/cve-2026-99150 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: don&#39;t drop the runtime PM reference twice in amdgpu_gpr</p> <p>amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count:</p> <p>amdgpu 0000:03:00.0: Runtime PM usage count underflow!</p> <p>The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path.</p> <p>(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: don&#39;t drop the runtime PM reference twice in amdgpu_gpr</p> <p>amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count:</p> <p>amdgpu 0000:03:00.0: Runtime PM usage count underflow!</p> <p>The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path.</p> <p>(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)</p> https://db.gcve.eu/vuln/cve-2026-99150