Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver that could lead to a system crash or instability. The issue occurs when the driver incorrectly attempts to release the same internal resource twice during a specific error handling process. This could potentially be exploited by a local user to cause a denial of service.
Technical details
A double-free vulnerability exists in the amdgpu driver within the Linux kernel's DRM subsystem. Specifically, in amdgpu_userq_vm_validate(), if amdgpu_ttm_tt_get_user_pages() fails, the code incorrectly jumps to a label that calls drm_exec_fini() a second time on an already finalized 'exec' object. Because drm_exec_fini() is not idempotent, this results in a double-free of exec->objects and potential corruption of the wait-wound (ww) acquire context. This issue has been resolved by routing the error path directly to range cleanup, bypassing the redundant finalization call.
Affected products
- Linux Linux 6.19 to 7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory