Improper locking in Linux kernel - CVE-2026-99147

Vulnerability details

The vulnerability allows a local user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to improper tracking of implicitly prelocked objects in the Linux kernel DRM execution locking helpers when recovering from lock contention. A prelocked object can remain in the locked-object array without a reserved dma_fence slot if the driver never explicitly locks it again. A local user can exercise graphics operations that encounter this condition to trigger a warning or kernel assertion failure when the driver uses drm_exec_for_each_locked_object() to add fences.

Affected software

How to mitigate CVE-2026-99147

External References

• https://git.kernel.org/stable/c/26401a4999f1596a515b2e704e7066ac09306488
• https://git.kernel.org/stable/c/7a10cd79c4d9a90334fece32fef3a8e5b1a9727b
• https://git.kernel.org/stable/c/96d9996e5dbcfabed052c0d9377a382c95fed607

Related Security Bulletins

• Improper locking in Linux kernel drm
• Debian update for linux