Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98519

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU156820

Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98519

Published: October 22, 2026


Vulnerability identifier: #VU156820
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98519
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to keep the GPU awake and increase power consumption by preventing runtime suspension.

The vulnerability exists due to a missing release of a runtime power management reference in amdgpu_debugfs_test_ib_show() when acquisition of the reset domain semaphore's write lock is interrupted. A local privileged user can invoke the debugfs test operation and interrupt its lock acquisition to leave the runtime power management reference held, preventing the GPU from entering runtime suspension.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

How to mitigate CVE-2026-98519

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

External References

Related Security Bulletins