https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:34:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89816 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used</p> <p>Commit 1c6ceeee6ebb (&#34;drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits&#34;) fixed a very similar issue when the event was allocated by drm_atomic_helper_setup_commit() itself.</p> <p>However, if the event is allocated in prepare_signaling(), it will also be set to NULL in complete_signaling(), which prevents drm_crtc_commit from being put in __drm_atomic_helper_crtc_destroy_state().</p> <p>Dropping the reference when the event is set to NULL at complete_signaling() fixes the leak.</p> <p>The leak can be reproduced by sending a signal to the thread using DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both with amdgpu and vkms.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used</p> <p>Commit 1c6ceeee6ebb (&#34;drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits&#34;) fixed a very similar issue when the event was allocated by drm_atomic_helper_setup_commit() itself.</p> <p>However, if the event is allocated in prepare_signaling(), it will also be set to NULL in complete_signaling(), which prevents drm_crtc_commit from being put in __drm_atomic_helper_crtc_destroy_state().</p> <p>Dropping the reference when the event is set to NULL at complete_signaling() fixes the leak.</p> <p>The leak can be reproduced by sending a signal to the thread using DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both with amdgpu and vkms.</p> https://vulnerability.circl.lu/vuln/cve-2026-89816