VulnerabilityPublished 19 Jul 2026

CVE-2026-63880: Linux kernel · drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO

Source GCVE Database

Not known to be exploited.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-5vfp-rcpc-cr39

What to do

AI-suggested

A fix has been implemented in the Linux kernel to route the failure path through the proper cleanup code, preventing the lock leak. Users should update their Linux kernel to a version that includes this patch. Since this is not a cloud service, remediation depends on applying the updated kernel. Patch status is not explicitly stated in the input data; users should consult the official Linux kernel advisories or distribution updates for the fixed version.

Description

A vulnerability in the Linux kernel's AMDGPU driver causes a lock leak on memory allocation failure in the AMDGPU_GEM_OP_GET_MAPPING_INFO ioctl call. This leak results in a denial of service condition where subsequent GPU operations block indefinitely, potentially leaving processes in an uninterruptible state until reboot. The issue affects unprivileged local users with access to /dev/dri/renderD* devices.

Impact

An unprivileged local user with access to /dev/dri/renderD* can trigger a denial of service against their own GPU context by causing the lock leak. Subsequent GPU operations block indefinitely, and the affected process may enter an uninterruptible sleep state (D state) that is not resolved even by SIGKILL, requiring a system reboot to recover. This impacts system stability and availability of GPU resources for the affected user.

Summary

The vulnerability occurs in the drm/amdgpu driver within the Linux kernel, specifically in the AMDGPU_GEM_OP_GET_MAPPING_INFO branch of the amdgpu_gem_op_ioctl() function. When kvcalloc() fails with -ENOMEM, the code path incorrectly bypasses the cleanup label 'out_exec', causing a lock leak of three resources including the per-process VM root page directory dma_resv lock. This leaked lock blocks further operations on the same VM, leading to a local denial of service for any process with access to the GPU rendering device. The issue was reproduced on Linux kernel 7.0.0-10 with Ryzen 7 5700U / Radeon Vega hardware. The fix involves routing the failure path through the cleanup label to properly release all held locks and references.

References

Community reviews

Loading reviews…