CVE-2026-97900

Received Received - Intake

Linux Kernel drm_exec Contention Handling Flaw

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/drm_exec: fix up contended obj when num_objects is 0 drm_exec_prepare_array() silently returns success without calling drm_exec_lock_contended() when num_objects is zero. This breaks the invariant upheld by drm_exec_lock_obj(), where every entry point into the locking sequence must first attempt to lock any previously contended object before proceeding. Drivers that chain multiple drm_exec_prepare_array() calls per drm_exec_until_all_locked() iteration (e.g. amdgpu's userq signal/wait ioctls, which prepare separate read and write BO arrays) can pass an empty array for one of the two calls. If contention is hit while preparing the non-empty array, exec->contended is set and the loop retries; on retry, the empty-array call preceding it is a no-op that never clears exec->contended, so drm_exec_retry_on_contention() immediately jumps back to the top of the loop without ever reaching the call that would resolve the contention. This spins forever. Fix it by having drm_exec_prepare_array() call drm_exec_lock_contended() directly when num_objects is zero, so a pending contended object dont loop infinitely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97900

EUVD

EUVD-2026-86754

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where drm_exec_prepare_array() fails to handle empty object arrays correctly. When num_objects is zero, it skips locking contended objects, breaking a critical invariant. This causes infinite loops in drivers like amdgpu when retrying operations under contention.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM (Direct Rendering Manager) subsystem and does not have network-based detection methods. Detection requires checking the kernel version and examining the DRM code for the affected function drm_exec_prepare_array(). Use commands like uname -a to check kernel version and grep to inspect the kernel source for the vulnerable function.

Impact Analysis

If you use Linux systems with affected GPU drivers (e.g., amdgpu), this flaw could cause system hangs or crashes during graphics operations. Specifically, it may freeze the system when handling certain GPU commands under contention.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel locking mechanism issue in the DRM subsystem. It may indirectly impact systems handling sensitive data if it causes system instability or crashes.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution that fixes the drm_exec_prepare_array() issue. If no patch is available, avoid using affected DRM drivers like amdgpu's userq signal/wait ioctls. Monitor kernel security advisories for updates and consider temporarily disabling DRM features if necessary.

Hi! I’m here to help you understand CVE-2026-97900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70