CVE-2026-98780: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98780 Overview

CVE-2026-98780 is a memory leak vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The flaw resides in amdgpu_discovery_sysfs_ips(), which allocates an ip_hw_instance structure with kzalloc_flex() and initializes its embedded kobject prior to calling kobject_add(). When kobject_add() fails, the return value is ignored and the initial kobject reference is never dropped, leaving the allocation orphaned. The fix invokes kobject_put() on failure so ip_hw_instance_release() can free the allocation.

Critical Impact
Repeated failures of sysfs IP instance registration during AMD GPU discovery can slowly exhaust kernel memory, degrading system stability over time.

Affected Products

Linux kernel versions containing the vulnerable amdgpu_discovery_sysfs_ips() implementation
Systems using the AMD GPU Direct Rendering Manager (DRM) driver
Distributions shipping kernels prior to the backported fix in stable trees

Discovery Timeline

2026-10-18 - CVE-2026-98780 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98780

Vulnerability Analysis

The defect lives in the AMD GPU discovery sysfs path. amdgpu_discovery_sysfs_ips() allocates each ip_hw_instance using kzalloc_flex() and initializes the embedded kobject before registering it in sysfs through kobject_add(). The caller ignores the return value of kobject_add(), so a failed registration never drops the initial reference taken during kobject initialization.

Because the failed kobject is not inserted into the kset list, the standard sysfs teardown path cannot reach it. The release callback ip_hw_instance_release() is therefore never invoked, and the backing allocation leaks for the lifetime of the kernel. The issue was identified through static analysis and confirmed by manual review, as described in the upstream commit message.

Root Cause

The root cause is improper reference handling after a failed kobject_add(). The Linux kobject API requires callers to invoke kobject_put() when kobject_add() fails so the initial reference taken at initialization is released, allowing the release callback to free associated memory. The amdgpu discovery routine omitted this step.

Attack Vector

This is a reliability and resource-exhaustion defect rather than a direct code-execution vector. Triggering the leak requires kobject_add() to fail during AMD GPU IP discovery, which typically occurs under memory pressure, sysfs namespace collisions, or hardware enumeration anomalies. Each failure leaks one ip_hw_instance allocation. No CWE identifier or CVSS vector has been assigned in the published advisory.

// No verified exploitation code is available for this vulnerability.
// Refer to the upstream kernel commits linked in the references section
// for the exact source changes implementing the fix.

Detection Methods for CVE-2026-98780

Indicators of Compromise

Gradual, unexplained growth in kernel slab memory usage on systems with AMD GPUs during driver initialization or re-probe cycles
Kernel log entries from drm/amdgpu referencing sysfs or kobject registration failures during IP discovery
Missing ip_hw_instance sysfs entries under /sys/class/drm/ corresponding to expected IP blocks

Detection Strategies

Compare running kernel versions against the fixed stable commits (0563b26, 7ca44cb, c05bbcc, f5a5add, f6364e72) using package inventory tooling
Monitor kmemleak reports on development or test systems for leaked allocations tied to amdgpu_discovery_sysfs_ips
Audit dmesg output for kobject_add failure messages originating from the amdgpu driver

Monitoring Recommendations

Track slab allocator metrics via /proc/slabinfo and node_exporter on hosts with AMD GPUs
Alert on repeated AMD GPU driver initialization failures that could amplify the leak
Centralize kernel logs in a SIEM or data lake to correlate GPU driver errors with host memory trends

How to Mitigate CVE-2026-98780

Immediate Actions Required

Inventory hosts running AMD GPUs and identify kernels that predate the patched stable releases
Schedule kernel upgrades to a version incorporating the fix on affected systems
Reboot affected systems after upgrade to ensure the patched amdgpu driver is loaded

Patch Information

The fix adds a kobject_put() call when kobject_add() fails, dropping the initial reference and allowing ip_hw_instance_release() to free the allocation. Existing best-effort behavior is preserved by continuing enumeration of remaining IP entries. The change has been backported across multiple stable trees in the following commits:

Workarounds

Reduce memory pressure during boot and GPU driver initialization to lower the probability of kobject_add() failures
Where feasible, blacklist the amdgpu module on systems that do not require the GPU driver until patched kernels are deployed
Reboot long-running hosts periodically to reclaim any leaked ip_hw_instance allocations until patched kernels are installed

bash

# Verify running kernel version and check for the patched amdgpu driver
uname -r
modinfo amdgpu | grep -E '^(version|srcversion|filename):'

# Review kernel log for amdgpu discovery errors indicating potential leak triggers
dmesg | grep -iE 'amdgpu.*(kobject|sysfs|discovery)'