In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr…
CVE-2026-99150
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtimeusage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copytouser() instead of the putuser() loop with its own error path. (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 30 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
- https://git.kernel.org/stable/c/24c1f6e381d564e5f6893323cfe0264950358451
- https://git.kernel.org/stable/c/253555a9baccefffe1f6e5f2fe54363c7c01ebb9
- https://git.kernel.org/stable/c/35aa048f242cade635f17924183c1df0ffe7a486
- https://git.kernel.org/stable/c/652b1f26125fe48aed5f4944698a85b457eef491
- https://git.kernel.org/stable/c/c333834b1b9cbb1021c954d29fa2373ac9e73499
- https://git.kernel.org/stable/c/de9f6bcdb44f0e410031002e2f103826ea6b6259
- https://git.kernel.org/stable/c/eda6b57a83d942199a5947e73556fe918affad86
- https://git.kernel.org/stable/c/f9c0b333a5e44f734478ca8a7345f8b87d65ba7c
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99150