Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-24T00:00:00 kernel: drm/amdgpu: avoid double drm_exec_fini() in userq validate 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-1341

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid double drm_exec_fini() in userq validate When new_addition is true, amdgpu_userq_vm_validate() calls drm_exec_fini(&exec) before iterating over the collected HMM ranges and calling amdgpu_ttm_tt_get_user_pages(). If amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to unlock_all and calls drm_exec_fini(&exec) a second time on the same exec object. drm_exec_fini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context. Route that error path directly to the range cleanup once exec has already been finalized. Issue found using a prototype static analysis tool and confirmed by code review. (cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)

A flaw was found in the Linux kernel. A double free vulnerability exists in the `drm/amdgpu` component within the `userq validate` function. This issue arises because the `drm_exec_fini()` function is called twice on the same execution object, which is not designed to be idempotent. An attacker could potentially exploit this to cause a denial of service or lead to unpredictable system behavior.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-52987 https://nvd.nist.gov/vuln/detail/CVE-2026-52987 https://lore.kernel.org/linux-cve-announce/2026062443-CVE-2026-52987-29bd@gregkh/T