SB20261029172 - Improper locking in Linux kernel drm

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-99147)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to improper tracking of implicitly prelocked objects in the Linux kernel DRM execution locking helpers when recovering from lock contention. A prelocked object can remain in the locked-object array without a reserved dma_fence slot if the driver never explicitly locks it again. A local user can exercise graphics operations that encounter this condition to trigger a warning or kernel assertion failure when the driver uses drm_exec_for_each_locked_object() to add fences.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/26401a4999f1596a515b2e704e7066ac09306488
• https://git.kernel.org/stable/c/7a10cd79c4d9a90334fece32fef3a8e5b1a9727b
• https://git.kernel.org/stable/c/96d9996e5dbcfabed052c0d9377a382c95fed607