CVE-2026-63880 (GCVE-0-2026-63880)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:54 – Updated: 2026-07-19 14:54
VLAI
Title
drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl() holds three cleanup-tracked resources before calling kvcalloc(): the drm_gem_object reference from drm_gem_object_lookup(), the drm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and the drm_exec lock on the per-process VM root page directory via amdgpu_vm_lock_pd(). All three are released by the out_exec label that every other error path in this function jumps to. The kvcalloc() failure path returns -ENOMEM directly, skipping out_exec and leaking all three. The leaked per-process VM root PD dma_resv lock is the load-bearing leak: any subsequent operation on the same VM (further GEM ops, command-submission, eviction, TTM shrinker callbacks) blocks on the held lock. DRM_IOCTL_AMDGPU_GEM_OP is DRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local denial of service against the caller's GPU context, reachable by any process with /dev/dri/renderD* access. Route the failure through out_exec so drm_exec_fini() and drm_gem_object_put() run. Reproduced on stock 7.0.0-10, Ryzen 7 5700U / Radeon Vega (Lucienne): the failing ioctl returns -ENOMEM and a second GET_MAPPING_INFO on the same fd then blocks in drm_exec_lock_obj() on the leaked dma_resv. SIGKILL on the caller does not reap the task; the fd-release path during process exit goes through amdgpu_gem_object_close() -> drm_exec_prepare_obj() on the same lock, leaving the task in D state until the box is rebooted. The patched kernel was not rebuilt and re-tested on this hardware; the fix is mechanical. Tested on a single Lucienne / Vega box only. Ziyi Guo posted an independent INT_MAX-bound check for args->num_entries in the same branch [1]; the two patches are complementary and can land in either order. (cherry picked from commit b69d3256d79de15f54c322986ff4da68f1d65b0a)
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4d82724f7f2b847eb0454b1aab5450545b39abd4 , < 1eb86334e391695d4a40743b114afc15df4dc506 (git)
Affected: 4d82724f7f2b847eb0454b1aab5450545b39abd4 , < 8f643d534ffc6f1b6182e4f3acff8f04890504b9 (git)
Affected: 4d82724f7f2b847eb0454b1aab5450545b39abd4 , < 2e7f55eb408c3f72ee1957a0d0ad11d8648a6379 (git)
Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1eb86334e391695d4a40743b114afc15df4dc506",
              "status": "affected",
              "version": "4d82724f7f2b847eb0454b1aab5450545b39abd4",
              "versionType": "git"
            },
            {
              "lessThan": "8f643d534ffc6f1b6182e4f3acff8f04890504b9",
              "status": "affected",
              "version": "4d82724f7f2b847eb0454b1aab5450545b39abd4",
              "versionType": "git"
            },
            {
              "lessThan": "2e7f55eb408c3f72ee1957a0d0ad11d8648a6379",
              "status": "affected",
              "version": "4d82724f7f2b847eb0454b1aab5450545b39abd4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO\n\nThe AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl()\nholds three cleanup-tracked resources before calling kvcalloc():\nthe drm_gem_object reference from drm_gem_object_lookup(), the\ndrm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and\nthe drm_exec lock on the per-process VM root page directory via\namdgpu_vm_lock_pd().  All three are released by the out_exec\nlabel that every other error path in this function jumps to.\nThe kvcalloc() failure path returns -ENOMEM directly, skipping\nout_exec and leaking all three.\n\nThe leaked per-process VM root PD dma_resv lock is the\nload-bearing leak: any subsequent operation on the same VM\n(further GEM ops, command-submission, eviction, TTM shrinker\ncallbacks) blocks on the held lock.  DRM_IOCTL_AMDGPU_GEM_OP is\nDRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local\ndenial of service against the caller\u0027s GPU context, reachable\nby any process with /dev/dri/renderD* access.\n\nRoute the failure through out_exec so drm_exec_fini() and\ndrm_gem_object_put() run.\n\nReproduced on stock 7.0.0-10, Ryzen 7 5700U / Radeon Vega\n(Lucienne): the failing ioctl returns -ENOMEM and a second\nGET_MAPPING_INFO on the same fd then blocks in\ndrm_exec_lock_obj() on the leaked dma_resv.  SIGKILL on the\ncaller does not reap the task; the fd-release path during\nprocess exit goes through amdgpu_gem_object_close() -\u003e\ndrm_exec_prepare_obj() on the same lock, leaving the task in D\nstate until the box is rebooted.  The patched kernel was not\nrebuilt and re-tested on this hardware; the fix is mechanical.\nTested on a single Lucienne / Vega box only.\n\nZiyi Guo posted an independent INT_MAX-bound check for\nargs-\u003enum_entries in the same branch [1]; the two patches are\ncomplementary and can land in either order.\n\n(cherry picked from commit b69d3256d79de15f54c322986ff4da68f1d65b0a)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:54:52.397Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1eb86334e391695d4a40743b114afc15df4dc506"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f643d534ffc6f1b6182e4f3acff8f04890504b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7f55eb408c3f72ee1957a0d0ad11d8648a6379"
        }
      ],
      "title": "drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63880",
    "datePublished": "2026-07-19T14:54:52.397Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-07-19T14:54:52.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63880",
      "date": "2026-07-21",
      "epss": "0.00198",
      "percentile": "0.09783"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63880\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:05.007\",\"lastModified\":\"2026-07-19T16:17:05.007\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO\\n\\nThe AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl()\\nholds three cleanup-tracked resources before calling kvcalloc():\\nthe drm_gem_object reference from drm_gem_object_lookup(), the\\ndrm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and\\nthe drm_exec lock on the per-process VM root page directory via\\namdgpu_vm_lock_pd().  All three are released by the out_exec\\nlabel that every other error path in this function jumps to.\\nThe kvcalloc() failure path returns -ENOMEM directly, skipping\\nout_exec and leaking all three.\\n\\nThe leaked per-process VM root PD dma_resv lock is the\\nload-bearing leak: any subsequent operation on the same VM\\n(further GEM ops, command-submission, eviction, TTM shrinker\\ncallbacks) blocks on the held lock.  DRM_IOCTL_AMDGPU_GEM_OP is\\nDRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local\\ndenial of service against the caller\u0027s GPU context, reachable\\nby any process with /dev/dri/renderD* access.\\n\\nRoute the failure through out_exec so drm_exec_fini() and\\ndrm_gem_object_put() run.\\n\\nReproduced on stock 7.0.0-10, Ryzen 7 5700U / Radeon Vega\\n(Lucienne): the failing ioctl returns -ENOMEM and a second\\nGET_MAPPING_INFO on the same fd then blocks in\\ndrm_exec_lock_obj() on the leaked dma_resv.  SIGKILL on the\\ncaller does not reap the task; the fd-release path during\\nprocess exit goes through amdgpu_gem_object_close() -\u003e\\ndrm_exec_prepare_obj() on the same lock, leaving the task in D\\nstate until the box is rebooted.  The patched kernel was not\\nrebuilt and re-tested on this hardware; the fix is mechanical.\\nTested on a single Lucienne / Vega box only.\\n\\nZiyi Guo posted an independent INT_MAX-bound check for\\nargs-\u003enum_entries in the same branch [1]; the two patches are\\ncomplementary and can land in either order.\\n\\n(cherry picked from commit b69d3256d79de15f54c322986ff4da68f1d65b0a)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4d82724f7f2b847eb0454b1aab5450545b39abd4\",\"lessThan\":\"1eb86334e391695d4a40743b114afc15df4dc506\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d82724f7f2b847eb0454b1aab5450545b39abd4\",\"lessThan\":\"8f643d534ffc6f1b6182e4f3acff8f04890504b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d82724f7f2b847eb0454b1aab5450545b39abd4\",\"lessThan\":\"2e7f55eb408c3f72ee1957a0d0ad11d8648a6379\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1eb86334e391695d4a40743b114afc15df4dc506\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2e7f55eb408c3f72ee1957a0d0ad11d8648a6379\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f643d534ffc6f1b6182e4f3acff8f04890504b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T20:00:51+00:00",
      "cve": "CVE-2026-63880",
      "id": "CVE-2026-63880",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63880.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.