CVE-2026-98780
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
drm/amdgpu: corrige la fuga de memoria de la instancia de IP en caso de fallo al añadir el kobject
amdgpu_discovery_sysfs_ips() asigna ip_hw_instance con kzalloc_flex() e inicializa su kobject incrustado antes de llamar a kobject_add().
Si kobject_add() falla, el valor de retorno se ignora y la ejecución continúa sin liberar la referencia inicial del kobject. El kobject fallido no se conserva en la lista del kset, por lo que la ruta de desmontaje normal de sysfs no puede encontrarlo. Como resultado, ip_hw_instance_release() nunca se invoca y la asignación de ip_hw_instance queda filtrada.
Leer descripción completaMostrar menos
Llame a kobject_put() cuando kobject_add() falle, de modo que se libere la referencia inicial y ip_hw_instance_release() pueda liberar la asignación. Mantenga el comportamiento de sysfs de mejor esfuerzo existente continuando con las entradas de IP restantes tras el registro fallido.
El fallo fue identificado por una herramienta de análisis estático que desarrollé y confirmado mediante revisión manual.
(cherry picked from commit 5c75fbcca8af1096d8d9415b91d8ea6212c22ee1)
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.18 %
- Percentil entre todas las CVEs puntuadas
- 7
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98780",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a6c40b178092f41b9d6cc8615697c14b1e5a1c3a",
"lessThan": "0563b26c1437fe7e25ea42c334eb85c0a703f8ff",
"versionType": "git"
},
{
"status": "affected",
"version": "a6c40b178092f41b9d6cc8615697c14b1e5a1c3a",
"lessThan": "7ca44cb14d0249992a8f1425ba004d6e2d16d255",
"versionType": "git"
},
{
"status": "affected",
"version": "a6c40b178092f41b9d6cc8615697c14b1e5a1c3a",
"lessThan": "c05bbcc263d67b8b158e2a52be7e3005895969d1",
"versionType": "git"
},
{
"status": "affected",
"version": "a6c40b178092f41b9d6cc8615697c14b1e5a1c3a",
"lessThan": "f5a5add3605935163dd0f75749b6a7869e9765af",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:31.960",
"references": [
{
"url": "https://git.kernel.org/stable/c/0563b26c1437fe7e25ea42c334eb85c0a703f8ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7ca44cb14d0249992a8f1425ba004d6e2d16d255",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c05bbcc263d67b8b158e2a52be7e3005895969d1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5a5add3605935163dd0f75749b6a7869e9765af",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix IP instance memory leak on kobject add failure\n\namdgpu_discovery_sysfs_ips() allocates ip_hw_instance with\nkzalloc_flex() and initializes its embedded kobject before calling\nkobject_add().\n\nIf kobject_add() fails, the return value is ignored and execution\ncontinues without dropping the initial kobject reference. The failed\nkobject is not retained in the kset list, so the normal sysfs teardown\npath cannot find it. As a result, ip_hw_instance_release() is never\ncalled and the ip_hw_instance allocation is leaked.\n\nCall kobject_put() when kobject_add() fails so the initial reference is\ndropped and ip_hw_instance_release() can free the allocation. Keep the\nexisting best-effort sysfs behavior by continuing with the remaining IP\nentries after the failed registration.\n\nThe issue was identified by a static analysis tool I developed and\nconfirmed by manual review.\n\n(cherry picked from commit 5c75fbcca8af1096d8d9415b91d8ea6212c22ee1)"
}
],
"lastModified": "2026-10-19T10:19:42.097",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}