Linux kernel drm_gpusvm: device mapping leak on the error path of drm_gpusvm_get_pages()

Impact

drm_gpusvm_get_pages() only recorded the device pagemap on success, so when a later page failed (for example -EOPNOTSUPP with ctx->allow_mixed clear) the unmap path saw a NULL dpagemap and skipped device_unmap(), leaving the device mappings already created in place. On a GPU node this is a resource leak in the shared-virtual-memory path used by GPU compute workloads: repeated failing allocations accumulate leaked device mappings, and reclaiming them needs the driver reloaded or the node rebooted. The record describes a leak on an error path, not a confirmed memory-corruption or cross-tenant read primitive, and the fix is a one-line assignment. The NVD score of 8.8 is the Linux CNA's blanket value and is not backed by any described exploitation path.

Who can reach it

Local user with access to a GPU device node that drives the gpusvm path, able to trigger the failing-page case repeatedly. Authentication to the node is required; no remote or network path.

What to do

Pick up the stable kernels carrying the fix (three stable commits are linked) and reboot each affected GPU node; the change is in the DRM GPU SVM core, so it cannot be hot-patched or applied by restarting a daemon. Nodes running a kernel without drm_gpusvm, or without accelerators using it, are not affected. No vendor advisory with fixed version strings is present in the record beyond the kernel git commits.

References

Related entries

• Linux kernel drm/vmwgfx: undersized DMA command lets one command rewrite another's verified fieldsCVE-2026-74443 · Linux kernel drm/vmwgfx (DMA command suffix bounds check in vmw_cmd_dma)High
• Linux kernel amdxdna: use-after-free on the IOMMU domain when the accelerator device is removedCVE-2026-80608 · Linux kernel accel/amdxdna (AMD XDNA NPU driver, IOMMU domain lifetime)High
• Linux kernel nouveau/dmem: large-folio migration unmaps PAGE_SIZE instead of the mapped size, leaking IOVACVE-2026-89804 · Linux kernel drm/nouveau/dmem (device-private THP migration, DMA unmap size)High
• Linux kernel amdkfd: no TLB flush after MES queue eviction lets in-flight DMA touch unmapped GPU memoryCVE-2026-89811 · Linux kernel drm/amdkfd (MES queue eviction/suspension, missing kfd_flush_tlb)High
• Linux drm/amdgpu gfx6: compute queues missed PFP sync, letting a submission run against stale stateCVE-2026-90286 · Linux kernel drm/amdgpu gfx6 (compute queue PFP synchronization)High
• drm/pagemap: migration error path clears the pages array before DMA-unmapping itCVE-2026-93284 · Linux kernel drm_pagemap (device-memory migration error path)High