Memory Leak Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2026-98780: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu_discovery_sysfs_ips() allocates ip_hw_instance with kzalloc_flex() and initializes... Affects linux versions 6.1.106-1 – 7.3~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various environments, from servers to personal computers. This vulnerability specifically affects the amdgpu driver within the kernel, which is responsible for managing AMD graphics cards. The issue arises from improper handling of memory allocation during the registration of IP instances, leading to potential memory leaks.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the amdgpu driver where the function amdgpu_discovery_sysfs_ips() allocates memory for ip_hw_instance using kzalloc_flex() and initializes its embedded kobject before calling kobject_add(). If kobject_add() fails, the initial reference to the kobject is not released, resulting in a memory leak as the failed kobject is not retained in the kset list. Consequently, the cleanup function ip_hw_instance_release() is never called, leading to unfreed memory allocations. This issue was discovered through static analysis and confirmed by manual review.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to prevent potential memory leaks.
Conclusion
The memory leak vulnerability in the Linux kernel's amdgpu driver poses a significant risk to systems running affected Debian packages. Users are strongly advised to update their kernel packages to the patched versions to prevent potential memory leaks and ensure system stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the Linux kernel's amdgpu driver that occurs when kobject_add() fails, leading to unfreed memory allocations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability can lead to increased memory usage over time, potentially causing system instability or crashes due to resource exhaustion.
Yes, patches are available for Debian 13 and 14. Users should update to the specified fixed versions to resolve the issue.
While there are no specific workarounds, it is crucial to monitor your system's memory usage and apply the patch as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
