Bug 2554829 (CVE-2026-98519)

Summary:	CVE-2026-98519 kernel: drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. A local user with access to the debugfs interface can trigger an interrupted lock operation during device testing, which prevents the driver from releasing an acquired runtime power management reference. Consequently, the graphics processing unit (GPU) cannot enter power-saving suspend states, leading to increased power consumption and resource exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-18 15:21:29 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

amdgpu_debugfs_test_ib_show() resumes the device with
pm_runtime_get_sync() before taking the reset domain semaphore with
down_write_killable().  If the write lock acquisition is interrupted,
the function returns without calling pm_runtime_put_autosuspend(),
leaking the runtime PM reference acquired for the device and keeping
the GPU awake.

Drop the runtime PM reference on the interrupted down_write_killable()
error path before returning.

(cherry picked from commit ec30a576c2d4c0364549e6c04218f50704ef56c8)