CVE-2026-52987

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: avoid double drm_exec_fini() in userq validate<br /> <br /> When new_addition is true, amdgpu_userq_vm_validate() calls<br /> drm_exec_fini(&amp;exec) before iterating over the collected HMM ranges and<br /> calling amdgpu_ttm_tt_get_user_pages().<br /> <br /> If amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to<br /> unlock_all and calls drm_exec_fini(&amp;exec) a second time on the same<br /> exec object. drm_exec_fini() is not idempotent: it frees exec-&gt;objects<br /> and may also drop exec-&gt;contended and finalize the ww acquire context.<br /> <br /> Route that error path directly to the range cleanup once exec has<br /> already been finalized.<br /> <br /> Issue found using a prototype static analysis tool<br /> and confirmed by code review.<br /> <br /> (cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)