CVE-2026-89816

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during

non-blocking commits") fixed a very similar issue when the event was

allocated by drm_atomic_helper_setup_commit() itself.

However, if the event is allocated in prepare_signaling(), it will also be

set to NULL in complete_signaling(), which prevents drm_crtc_commit from

being put in __drm_atomic_helper_crtc_destroy_state().

Dropping the reference when the event is set to NULL at

complete_signaling() fixes the leak.

The leak can be reproduced by sending a signal to the thread using

DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic

ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both

with amdgpu and vkms.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References