CVE-2026-98997
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents are lost. Since an importer on the same device gets the exporter's GEM object, a client can do this to a buffer another client shared with it. Reject BOs that were not created in the doorbell domain. v2: drop the error message, use a local abo variable (Christian) (cherry picked from commit f7497bbc19db4821c62b9d97b31c9086feb2d917)
How to fix
- Linux Linux112dbe2b10d6d088a6c599980dd960dcbfa55ff0, 8640b3f961d743d6dc0458c2b53a3af434690cc1, 7f7c88dbf4d543f6703e53bdeed380e886733167 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 ≤ v < 112dbe2b10d6d088a6c599980dd960dcbfa55ff0, f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 ≤ v < 8640b3f961d743d6dc0458c2b53a3af434690cc1, f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 ≤ v < 7f7c88dbf4d543f6703e53bdeed380e886733167, 6.16 | 112dbe2b10d6d088a6c599980dd960dcbfa55ff0, 8640b3f961d743d6dc0458c2b53a3af434690cc1, 7f7c88dbf4d543f6703e53bdeed380e886733167 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.