Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98179

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU153839

Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98179

Published: October 7, 2026


Vulnerability identifier: #VU153839
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98179
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to consume kernel mapping resources.

The vulnerability exists due to failure to release register BAR mappings in amdgpu_device_fini_sw() when removing a device or unloading the driver. A local privileged user can trigger driver unloading, leaking one register BAR mapping per unload, to consume kernel mapping resources.


Affected software

Linux kernel
Debian Linux
linux (Debian package)

How to mitigate CVE-2026-98179

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1

External References

Related Security Bulletins