VulnerabilityPublished 19 Jul 2026

CVE-2026-63880: Linux kernel · drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO

Affects Linux kernelSource GCVE Database

Compare

Not known to be exploited.

Data as of 30 Oct 2026, 15:35 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

A patch has been applied to the Linux kernel to fix the lock leak by ensuring proper cleanup on kvcalloc() failure in the AMDGPU_GEM_OP_GET_MAPPING_INFO ioctl handler. Users should update to a Linux kernel version that includes this fix. No other mitigation or workaround is indicated.

Description

A lock leak vulnerability in the Linux kernel's AMDGPU driver was fixed. The flaw occurs in the AMDGPU_GEM_OP_GET_MAPPING_INFO ioctl handling, where a failure path on memory allocation error (-ENOMEM) skips proper cleanup, causing a lock to remain held. This leads to a local denial of service for unprivileged users with access to /dev/dri/renderD* devices, blocking further GPU operations and potentially leaving processes stuck in uninterruptible sleep until reboot.

Impact

Unprivileged local users with access to /dev/dri/renderD* devices can cause a denial of service by triggering the lock leak, which blocks further GPU operations on the affected VM. Processes using the GPU context may become stuck in uninterruptible sleep (D state) and not be reaped until system reboot, impacting system stability and availability for GPU workloads.

Summary

The vulnerability in the Linux kernel AMDGPU driver involves a lock leak on an ENOMEM error in the AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl(). Three resources are held before a kvcalloc() call: a drm_gem_object reference, a drm_exec lock on the GEM object, and a drm_exec lock on the per-process VM root page directory. If kvcalloc() fails, the error path returns -ENOMEM directly without releasing these locks, causing a leak. The leaked dma_resv lock on the VM root page directory blocks subsequent operations on the same VM, including further GEM operations and command submissions. Since the ioctl is accessible to unprivileged local users with render device access, this results in a local denial of service against the caller's GPU context. The issue was reproduced on Linux kernel 7.0.0-10 with Ryzen 7 5700U / Radeon Vega hardware. The fix routes the failure through the proper cleanup label to release all held locks and references. No public exploits or CVSS score are available.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 30 Oct 2026, 15:35 UTC

Technical details

References

Community reviews

Related threats