Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

amdgpu_debugfs_test_ib_show() resumes the device with
pm_runtime_get_sync() before taking the reset domain semaphore with
down_write_killable(). If the write lock acquisition is interrupted,
the function returns without calling pm_runtime_put_autosuspend(),
leaking the runtime PM reference acquired for the device and keeping
the GPU awake.

Drop the runtime PM reference on the interrupted down_write_killable()
error path before returning.

(cherry picked from commit ec30a576c2d4c0364549e6c04218f50704ef56c8)
Published: 2026-10-18
Score: 1.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Runtime power‑management reference leak keeping the GPU powered on
Action: Apply patch
AI Analysis

Impact

In the Linux kernel, the amdgpu_debugfs_test_ib_show() function resumes the GPU device with pm_runtime_get_sync() before acquiring the reset domain semaphore with down_write_killable(). If the semaphore acquisition is interrupted and the function returns, it fails to call pm_runtime_put_autosuspend(), leaving a runtime power‑management reference that prevents the GPU from suspending. The leaked reference keeps the GPU awake, causing increased power consumption and potential battery drain, but it does not provide code execution or denial of service capabilities. Based on the description, it is inferred that the unintended wake‑up of the GPU may also affect overall system energy efficiency.

Affected Systems

All Linux kernel releases containing the unpatched amdgpu_debugfs_test_ib_show() function are affected. Any distribution that uses such a kernel with an AMDGPU‑capable GPU and exposes the amdgpu_debugfs_test_ib_show() debugfs entry is vulnerable. The CVE data does not specify affected versions; the patch that introduced the fix is identified by commit ec30a576c2d4c0364549e6c04218f50704ef56c8.

Risk and Exploitability

The CVSS score of 1.9 indicates low severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves local access to the amdgpu_debugfs_test_ib_show() debugfs file and an interrupted down_write_killable() call—details about how to reliably trigger this interruption are not provided, so practical exploitation is considered unlikely. The primary risk is increased power consumption rather than direct security impact.

Generated by OpenCVE AI on October 20, 2026 at 19:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that releases the runtime PM reference when the down_write_killable() call fails (commit ec30a576c2d4c0364549e6c04218f50704ef56c8).
  • If a patch is not immediately available, restrict the amdgpu_debugfs_test_ib_show() debugfs file to privileged users (e.g., chmod 700).
  • As a temporary measure, remove or disable the amdgpu_debugfs_test_ib_show() debugfs entry until the patch is applied.

Generated by OpenCVE AI on October 20, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4850-1 linux-6.12 security update
History

Fri, 30 Oct 2026 12:45:00 +0000


Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399
CWE-404

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

cvssV3_1

{'score': 1.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low


Mon, 19 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399
CWE-404

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() amdgpu_debugfs_test_ib_show() resumes the device with pm_runtime_get_sync() before taking the reset domain semaphore with down_write_killable(). If the write lock acquisition is interrupted, the function returns without calling pm_runtime_put_autosuspend(), leaking the runtime PM reference acquired for the device and keeping the GPU awake. Drop the runtime PM reference on the interrupted down_write_killable() error path before returning. (cherry picked from commit ec30a576c2d4c0364549e6c04218f50704ef56c8)
Title drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-30T12:38:22.800Z

Reserved: 2026-09-25T10:25:14.354Z

Link: CVE-2026-98519

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:03.260

Modified: 2026-10-30T13:21:15.693

Link: CVE-2026-98519

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98519 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:00:15Z

Weaknesses
  • CWE-911

    Improper Update of Reference Count