CVE-2026-98780
Received Received - Intake

Memory Leak in Linux Kernel AMDGPU Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu_discovery_sysfs_ips() allocates ip_hw_instance with kzalloc_flex() and initializes its embedded kobject before calling kobject_add(). If kobject_add() fails, the return value is ignored and execution continues without dropping the initial kobject reference. The failed kobject is not retained in the kset list, so the normal sysfs teardown path cannot find it. As a result, ip_hw_instance_release() is never called and the ip_hw_instance allocation is leaked. Call kobject_put() when kobject_add() fails so the initial reference is dropped and ip_hw_instance_release() can free the allocation. Keep the existing best-effort sysfs behavior by continuing with the remaining IP entries after the failed registration. The issue was identified by a static analysis tool I developed and confirmed by manual review. (cherry picked from commit 5c75fbcca8af1096d8d9415b91d8ea6212c22ee1)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98780
EUVD
EUVD-2026-103865

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux a6c40b178092f41b9d6cc8615697c14b1e5a1c3a
Linux Linux a6c40b178092f41b9d6cc8615697c14b1e5a1c3a
Linux Linux a6c40b178092f41b9d6cc8615697c14b1e5a1c3a
Linux Linux a6c40b178092f41b9d6cc8615697c14b1e5a1c3a
Linux Linux 5.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Linux kernel's AMD GPU driver. It occurs when a kobject fails to initialize properly during sysfs registration. The driver allocates memory for IP instance tracking but fails to release it if kobject registration fails, causing a resource leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD GPU driver and involves a memory leak during kobject initialization. Detection requires checking for kernel logs or memory leaks related to AMD GPU IP instances. Use commands like dmesg | grep -i amdgpu or journalctl -k | grep -i amdgpu to inspect kernel logs for errors during GPU driver initialization.

Impact Analysis

The impact is primarily on system stability and resource usage. The memory leak could gradually consume system memory over time, potentially leading to performance degradation or crashes in systems using AMD GPUs with affected kernel versions.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the AMD GPU driver or restricting access to GPU functionality as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart