Improper update of reference count in Linux kernel - CVE-2026-89816
Published: September 17, 2026
Vulnerability identifier: #VU150475
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89816
CWE-ID: CWE-911
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a memory leak.
The vulnerability exists due to improper reference counting in complete_signaling() in the DRM atomic UAPI when an atomic DRM ioctl using DRM_MODE_PAGE_FLIP_EVENT is blocked while waiting for fences. A local user can issue the atomic DRM ioctl with a sw_sync fence and send a signal to the blocked thread to cause a memory leak.
The condition was observed with amdgpu and vkms.
Affected software
Linux kernel
How to mitigate CVE-2026-89816
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/4d4be202165e832d74849b4a68e289a2a377039c
- https://git.kernel.org/stable/c/66b1b309886337745d395bbc158440ab196305ce
- https://git.kernel.org/stable/c/6a6a7aae4681a20cd32789fea9a487aaafa0e7a3
- https://git.kernel.org/stable/c/866a04137dac7e82a3848851061ff7ed15c2847e
- https://git.kernel.org/stable/c/c5517b71101f61a45144e3cf77a19626355272de
- https://git.kernel.org/stable/c/e2f27b5ed9084feb7bae9ef2bc80de37c92280b1
- https://git.kernel.org/stable/c/e6195b941fdc8d81fc431c9f25539cf6c6234b51
- https://git.kernel.org/stable/c/ff73f5f43d032c3da3c534c517f661e8dfeb358a