Executive brief
The Linux kernel's Direct Rendering Manager (DRM) subsystem contains a memory leak in its graphics page-flip event handling. When an application sends a page-flip event signal and a synchronization fence blocks the operation, kernel memory is not properly freed. This leak can accumulate over time on systems using AMD or virtual graphics drivers, potentially degrading system performance or causing memory exhaustion in long-running applications.
Technical details
This is a memory leak in the DRM atomic graphics subsystem, specifically in the drm_atomic_uapi.c file's complete_signaling() function. The vulnerability occurs when a DRM_MODE_PAGE_FLIP_EVENT is allocated in prepare_signaling() but the event reference is set to NULL in complete_signaling() without properly decrementing the refcount of the associated drm_crtc_commit object. This prevents the drm_crtc_commit from being released in __drm_atomic_helper_crtc_destroy_state(). The leak is triggered when a signal is sent to a thread using PAGE_FLIP_EVENT while an atomic ioctl is blocked at drm_atomic_helper_wait_for_fences() (e.g., via a sw_sync fence). The fix adds an explicit drm_crtc_commit_put() call when the event is nullified, ensuring proper reference counting. The issue affects amdgpu and vkms drivers.
Affected products
- Linux Linux kernel Multiple versions (fix backported to numerous stable series)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-07-27: patched: Fix committed upstream (commit 4d4be202165e832d74849b4a68e289a2a377039c)
- 2026-09-11: patched: Fix included in stable releases