CVE-2026-97900

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/drm_exec: fix up contended obj when num_objects is 0

drm_exec_prepare_array() silently returns success without calling

drm_exec_lock_contended() when num_objects is zero. This breaks the

invariant upheld by drm_exec_lock_obj(), where every entry point into

the locking sequence must first attempt to lock any previously

contended object before proceeding.

Drivers that chain multiple drm_exec_prepare_array() calls per

drm_exec_until_all_locked() iteration (e.g. amdgpu's userq signal/wait

ioctls, which prepare separate read and write BO arrays) can pass an

empty array for one of the two calls. If contention is hit while

preparing the non-empty array, exec->contended is set and the loop

retries; on retry, the empty-array call preceding it is a no-op that

never clears exec->contended, so drm_exec_retry_on_contention()

immediately jumps back to the top of the loop without ever reaching

the call that would resolve the c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References