CVE-2026-98519 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
amdgpu_debugfs_test_ib_show() resumes the device with pm_runtime_get_sync() before taking the reset domain semaphore with down_write_killable(). If the write lock acquisition is interrupted, the function returns without calling pm_runtime_put_autosuspend(), leaking the runtime PM reference acquired for the device and keeping the GPU awake.
Drop the runtime PM reference on the interrupted down_write_killable() error path before returning.
(cherry picked from commit ec30a576c2d4c0364549e6c04218f50704ef56c8)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel's AMDGPU driver involves a resource management flaw within the amdgpu_debugfs_test_ib_show function, specifically concerning runtime power management reference counting. This issue arises from an improper handling of asynchronous operations and error paths during device initialization or testing sequences. The core technical flaw lies in the sequence of operations where pm_runtime_get_sync is invoked to resume the GPU device before attempting to acquire a write lock on the reset domain semaphore using down_write_killable. While acquiring this lock is necessary for safe access to shared hardware resources, the function does not adequately account for scenarios where the wait for the lock is interrupted by signals or other asynchronous events. In such cases, the execution flow bypasses the normal cleanup routine that would normally release the power management reference via pm_runtime_put_autosuspend.
This oversight results in a persistent leak of runtime PM references associated with the GPU device. Each time this function is executed and subsequently interrupted during lock acquisition, the kernel retains an active reference to the powered-on state without releasing it upon exit. Over repeated occurrences or under sustained load conditions involving debugfs interactions, these leaked references accumulate effectively preventing the power management subsystem from suspending the device when idle. The operational impact of this condition includes increased power consumption and potential thermal issues due to the GPU remaining in an active state unnecessarily. Furthermore, excessive accumulation of such leaks can eventually lead to resource exhaustion within the kernel's runtime PM framework, potentially causing system instability or failure to suspend other devices that depend on similar reference counting mechanisms.
From a classification perspective, this vulnerability aligns with CWE-401 which describes missing release of memory after successful allocation and CWE-756 related to improper use of unusual logical operators in error handling paths within the context of resource management. In terms of attack vectors or exploitation potential, while primarily affecting system stability rather than directly enabling privilege escalation or remote code execution, it falls under ATT&CK technique T1499 which covers endpoint denial of service through exhaustion of resources such as memory handles or power states. An attacker with access to the debugfs interface could theoretically trigger this condition repeatedly to degrade system performance or cause a denial of service by keeping critical hardware components awake and consuming energy indefinitely.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects the error path logic within amdgpu_debugfs_test_ib_show. The fix ensures that if down_write_killable returns an error indicating interruption, the function explicitly calls pm_runtime_put_autosuspend to release the previously acquired runtime PM reference before returning control to the caller. Administrators should ensure their systems are updated with kernel versions containing this cherry-picked commit ec30a576c2d4c0364549e6c04218f50704ef56c8 or later. Additionally, monitoring system power states and GPU idle times can help detect anomalies indicative of such leaks in environments where immediate patching is not feasible. Regular auditing of kernel logs for warnings related to runtime PM reference imbalances may also provide early indicators of this issue manifesting in production systems.