Cloudanix VulnDB

CVE-2026-99150

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A power management mistake in AMD graphics drivers can cause system errors when certain low-level debug reads fail.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Double decrement of runtime PM reference count in amdgpu_debugfs_gpr_read() when copy_to_user fails after wave register read, causing usage count underflow or stolen reference on Navi31 hardware.

Why it matters to the business

Kernel warnings and potential graphics driver instability or power management failures on affected AMD GPUs, reducing system reliability during debug or register inspection operations.

How an attack unfolds

An attacker with sufficient privileges to access debugfs triggers amdgpu_debugfs_gpr_read on a Navi31 device and forces a copy_to_user failure to execute the erroneous second reference drop path.

How to fix it

Update the Linux kernel to a version containing the fix that performs hardware access first then executes a single copy_to_user, eliminating the second put in the error path.

How to confirm the fix worked

Confirm the patched commit is present in the running kernel source; reproduce a failing userspace copy during GPR read and verify no underflow message is emitted in dmesg.

Typical attack path

  1. Obtain local access with permissions to interact with amdgpu debugfs entries
  2. Invoke amdgpu_debugfs_gpr_read() via userspace read on the GPR debug file
  3. Supply or force a failing userspace buffer copy after hardware register read completes
  4. Observe or trigger the resulting runtime PM reference underflow

How to detect it

Search kernel logs and dmesg for amdgpu runtime PM usage count underflow messages or repeated reference count anomalies following debugfs GPR access attempts.

  • Runtime PM usage count underflow!
  • amdgpu.*Runtime PM usage count underflow

What your security team should do

  • Apply the upstream kernel fix for amdgpu runtime PM handling as soon as it reaches distribution channels
  • Monitor kernel logs for amdgpu runtime PM usage count underflow messages
  • Restrict unprivileged access to amdgpu debugfs interfaces until patched kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path. (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)

Affected packages

Ecosystem Package Introduced Fixed