{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74416", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.893Z", "datePublished": "2026-08-15T05:59:22.077Z", "dateUpdated": "2026-08-17T05:18:58.660Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:18:58.660Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix memory leak in radeon_ring_restore() on lock failure\n\nradeon_ring_restore() takes ownership of the data buffer allocated by\nradeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in\nthe non-restore branch; in the restore branch it relies on\nradeon_ring_restore() to free it.\n\nIf radeon_ring_lock() fails, the function returned early without calling\nkvfree(data), leaking the ring backup buffer on every GPU reset that\nfails at the lock stage. During repeated GPU resets this causes\ncumulative kernel memory exhaustion.\n\nFree data before returning the error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/radeon/radeon_ring.c"], "versions": [{"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "63912418f1fbb6456ea04bbcdf8f4d5090d23350", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "919e3e398bf301c6418dffdcd5e5c4fd9be39cf7", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "07c213f3499dd72e2922c1c73fe9ffea24874bef", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "1c9ba32308c02c198c378fcdf06be9ffc3111147", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "eecfb76129ebef7e3aa41e18a4668cd91dfc6267", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "06dc892561f5a08b2493c34c8ec2cb94dea33159", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "ccc42187fc2d0720947a63ce1b9e399d2c068ff4", "status": "affected", "versionType": "git"}, {"version": "55d7c22192becd0ec827a6901899ff56fa985658", "lessThan": "82f1d6042611d45b8b9de423bbcb4e0ced9ec62b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/radeon/radeon_ring.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/63912418f1fbb6456ea04bbcdf8f4d5090d23350"}, {"url": "https://git.kernel.org/stable/c/919e3e398bf301c6418dffdcd5e5c4fd9be39cf7"}, {"url": "https://git.kernel.org/stable/c/07c213f3499dd72e2922c1c73fe9ffea24874bef"}, {"url": "https://git.kernel.org/stable/c/1c9ba32308c02c198c378fcdf06be9ffc3111147"}, {"url": "https://git.kernel.org/stable/c/eecfb76129ebef7e3aa41e18a4668cd91dfc6267"}, {"url": "https://git.kernel.org/stable/c/06dc892561f5a08b2493c34c8ec2cb94dea33159"}, {"url": "https://git.kernel.org/stable/c/ccc42187fc2d0720947a63ce1b9e399d2c068ff4"}, {"url": "https://git.kernel.org/stable/c/82f1d6042611d45b8b9de423bbcb4e0ced9ec62b"}], "title": "drm/radeon: fix memory leak in radeon_ring_restore() on lock failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/radeon/radeon_ring.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "63912418f1fbb6456ea04bbcdf8f4d5090d23350", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "919e3e398bf301c6418dffdcd5e5c4fd9be39cf7", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "07c213f3499dd72e2922c1c73fe9ffea24874bef", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "1c9ba32308c02c198c378fcdf06be9ffc3111147", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "eecfb76129ebef7e3aa41e18a4668cd91dfc6267", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "06dc892561f5a08b2493c34c8ec2cb94dea33159", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "ccc42187fc2d0720947a63ce1b9e399d2c068ff4", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}, {"lessThan": "82f1d6042611d45b8b9de423bbcb4e0ced9ec62b", "status": "affected", "version": "55d7c22192becd0ec827a6901899ff56fa985658", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/radeon/radeon_ring.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"lessThan": "3.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix memory leak in radeon_ring_restore() on lock failure\n\nradeon_ring_restore() takes ownership of the data buffer allocated by\nradeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in\nthe non-restore branch; in the restore branch it relies on\nradeon_ring_restore() to free it.\n\nIf radeon_ring_lock() fails, the function returned early without calling\nkvfree(data), leaking the ring backup buffer on every GPU reset that\nfails at the lock stage. During repeated GPU resets this causes\ncumulative kernel memory exhaustion.\n\nFree data before returning the error."}], "id": "CVE-2026-74416", "lastModified": "2026-08-17T06:19:37.063", "metrics": {}, "published": "2026-08-15T06:22:43.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06dc892561f5a08b2493c34c8ec2cb94dea33159"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07c213f3499dd72e2922c1c73fe9ffea24874bef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c9ba32308c02c198c378fcdf06be9ffc3111147"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63912418f1fbb6456ea04bbcdf8f4d5090d23350"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/82f1d6042611d45b8b9de423bbcb4e0ced9ec62b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/919e3e398bf301c6418dffdcd5e5c4fd9be39cf7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ccc42187fc2d0720947a63ce1b9e399d2c068ff4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eecfb76129ebef7e3aa41e18a4668cd91dfc6267"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure", "id": "2516833", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516833"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/radeon: fix memory leak in radeon_ring_restore() on lock failure\nradeon_ring_restore() takes ownership of the data buffer allocated by\nradeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in\nthe non-restore branch; in the restore branch it relies on\nradeon_ring_restore() to free it.\nIf radeon_ring_lock() fails, the function returned early without calling\nkvfree(data), leaking the ring backup buffer on every GPU reset that\nfails at the lock stage. During repeated GPU resets this causes\ncumulative kernel memory exhaustion.\nFree data before returning the error.", "A flaw was found in the Linux kernel's drm/radeon component. When a Graphics Processing Unit (GPU) reset operation fails to acquire a necessary lock, a memory buffer is not properly released. Repeated occurrences of this issue can lead to a gradual depletion of kernel memory. This memory exhaustion can ultimately result in a system crash or denial of service."], "name": "CVE-2026-74416", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74416\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74416\nhttps://lore.kernel.org/linux-cve-announce/2026081512-CVE-2026-74416-b7cc@gregkh/T"], "threat_severity": "Low"}