CVE-2026-63880

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO

The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl()

holds three cleanup-tracked resources before calling kvcalloc():

the drm_gem_object reference from drm_gem_object_lookup(), the

drm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and

the drm_exec lock on the per-process VM root page directory via

amdgpu_vm_lock_pd(). All three are released by the out_exec

label that every other error path in this function jumps to.

The kvcalloc() failure path returns -ENOMEM directly, skipping

out_exec and leaking all three.

The leaked per-process VM root PD dma_resv lock is the

load-bearing leak: any subsequent operation on the same VM

(further GEM ops, command-submission, eviction, TTM shrinker

callbacks) blocks on the held lock. DRM_IOCTL_AMDGPU_GEM_OP is

DRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local

denial of service

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References