In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell… (CVE-2026-98997)

The vulnerability in the Linux kernel's AMDGPU driver involved the function amdgpu_userq_get_doorbell_index() improperly accepting any buffer object (BO) as a doorbell handle and pinning it into the doorbell domain. For regular BOs, this caused the TTM memory manager to move the BO with ttm_bo_move_null(), resulting in loss of the buffer's contents. Since an importer on the same device accesses the exporter's GEM object, a malicious client could exploit this to disrupt buffers shared with another client. The patch enforces that only BOs created in the doorbell domain are accepted as queue doorbells, preventing misuse.

The vulnerability could lead to loss of buffer contents for shared buffers between clients on the same device, potentially causing data corruption or denial of service conditions in graphics workloads using the AMDGPU driver. There is no indication of remote exploitation or privilege escalation from the provided data.

A fix has been applied to the Linux kernel AMDGPU driver that rejects buffer objects not created in the doorbell domain as queue doorbells. Users should update to the kernel version containing this patch to remediate the vulnerability. No additional mitigation steps are indicated.