{"id":"CVE-2026-99150","published":"2026-10-28T11:17:35.097","lastModified":"2026-10-28T11:17:35.097","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr\n\namdgpu_debugfs_gpr_read() drops its runtime PM reference right after\nreading the wave registers. When copying them to userspace fails, it\njumps to the err label, which drops the reference a second time. A read\ninto a bad buffer on Navi31 either steals a reference somebody else\nholds (power/runtime_usage goes from 1 to 0) or underflows the count:\n\n  amdgpu 0000:03:00.0: Runtime PM usage count underflow!\n\nThe registers are already in the kernel buffer at that point, so finish\nthe hardware access first and copy the buffer with a single\ncopy_to_user() instead of the put_user() loop with its own error path.\n\n(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/253555a9baccefffe1f6e5f2fe54363c7c01ebb9","tags":[]},{"url":"https://git.kernel.org/stable/c/652b1f26125fe48aed5f4944698a85b457eef491","tags":[]},{"url":"https://git.kernel.org/stable/c/de9f6bcdb44f0e410031002e2f103826ea6b6259","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}