Strix
73.2K

CVE-2026-99150

UnknownEPSS 0.17%

Last modified

CVE-2026-99150 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path. (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)

Metrics

EPSS Probability
0.17%

6.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < 24c1f6e381d564e5f6893323cfe0264950358451; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < c333834b1b9cbb1021c954d29fa2373ac9e73499; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < eda6b57a83d942199a5947e73556fe918affad86; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < f9c0b333a5e44f734478ca8a7345f8b87d65ba7c; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < 35aa048f242cade635f17924183c1df0ffe7a486; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < 652b1f26125fe48aed5f4944698a85b457eef491; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < 253555a9baccefffe1f6e5f2fe54363c7c01ebb9; >= 9eee152aab56d374edb9ad21b3db05f5cdda2fe6, < de9f6bcdb44f0e410031002e2f103826ea6b6259; 865e2dbadf6856c9219626fbd6154cac44e5fbca; >= 5.8.2, < 5.9
LinuxLinux5.9

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99150?
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path. (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)
How severe is CVE-2026-99150?
Severity scoring for CVE-2026-99150 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99150?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99150?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST