CVE-2026-99150

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path. (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)

Is your site exposed to CVE-2026-99150?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.08%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/24c1f6e381d564e5f6893323cfe0264950358451 https://git.kernel.org/stable/c/253555a9baccefffe1f6e5f2fe54363c7c01ebb9 https://git.kernel.org/stable/c/35aa048f242cade635f17924183c1df0ffe7a486 https://git.kernel.org/stable/c/652b1f26125fe48aed5f4944698a85b457eef491 https://git.kernel.org/stable/c/c333834b1b9cbb1021c954d29fa2373ac9e73499 https://git.kernel.org/stable/c/de9f6bcdb44f0e410031002e2f103826ea6b6259 https://git.kernel.org/stable/c/eda6b57a83d942199a5947e73556fe918affad86 https://git.kernel.org/stable/c/f9c0b333a5e44f734478ca8a7345f8b87d65ba7c

Frequently Asked Questions

What is CVE-2026-99150? +

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path. (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)

How do I check if I'm vulnerable to CVE-2026-99150? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.