CVE-2026-98519

What it actually does

A runtime PM reference acquired via pm_runtime_get_sync() in amdgpu_debugfs_test_ib_show() is leaked when down_write_killable() on the reset domain semaphore is interrupted, because pm_runtime_put_autosuspend() is never called on that error path.

Why it matters to the business

Systems may experience unnecessary GPU power consumption and inability to enter low-power states, increasing energy use and reducing battery life on laptops and mobile devices.

How an attack unfolds

An attacker with access to the debugfs interface would invoke amdgpu_debugfs_test_ib_show() and arrange for the semaphore acquisition to be interrupted by a signal, leaving a dangling runtime PM reference that keeps the GPU awake; the bug is not known to be used by any threat actors.

How to fix it

Apply the upstream fix that adds the missing pm_runtime_put_autosuspend() call on the interrupted semaphore path; rebuild and deploy the corrected kernel.

How to confirm the fix worked

Confirm the presence of the corrected error-handling path in amdgpu_debugfs_test_ib_show() after applying the patch and verify that runtime PM references are properly balanced under interrupt conditions.

Typical attack path

1. Obtain access to the amdgpu debugfs entry
2. Trigger amdgpu_debugfs_test_ib_show()
3. Cause down_write_killable() to be interrupted
4. Observe the leaked runtime PM reference

How to detect it

Review kernel logs for repeated calls to amdgpu_debugfs_test_ib_show() followed by signal interruptions; inspect runtime PM reference counts for the GPU device when the function returns early.

What your security team should do

• Patch affected kernels with the provided fix as soon as packages become available
• Restrict debugfs access to privileged users only
• Monitor power-management behavior on systems with AMD GPUs for unexpected wake-ups