CVE-2026-52987

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Multiple Releases of Same Resource or Handle pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid double drm_exec_fini() in userq validate When new_addition is true, amdgpu_userq_vm_validate() calls drm_exec_fini(&exec) before iterating over the collected HMM ranges and calling amdgpu_ttm_tt_get_user_pages(). If amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to unlock_all and calls drm_exec_fini(&exec) a second time on the same exec object. drm_exec_fini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context. Route that error path directly to the range cleanup once exec has already been finalized. Issue found using a prototype static analysis tool and confirmed by code review. (cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)

Rincian

Terbit di NVD

24 Juni 2026

Terakhir diubah

10 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1341: Multiple Releases of Same Resource or Handle

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/508babf310365f1107a2e8831c267c292a286818 patch
• https://git.kernel.org/stable/c/c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38 patch
• https://access.redhat.com/security/cve/CVE-2026-52987 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2492365 issue tracking · advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52987.json advisory pihak ketiga