CVE-2026-99090 Linux CVE debrief

Who should care

Linux kernel maintainers, users of the drm/amdgpu module, system administrators responsible for maintaining Linux systems, and Linux distribution maintainers should assess exposure, verify the presence of the fix, and monitor system logs for any issues related to the drm/amdgpu module.

Why it matters

The CVE-2026-99090 vulnerability in the Linux kernel's drm/amdgpu module can lead to lockdep warnings during GPU recovery. Defenders should assess exposure, verify the fix, and monitor system logs.

• Defenders should verify the presence of the fix in their Linux kernel versions to prevent potential lockdep warnings.
• System administrators should monitor system logs for any issues related to the drm/amdgpu module.
• Maintainers of Linux distributions should ensure that the fix is included in their kernel packages.

Technical summary

The vulnerability is in the drm/amdgpu module of the Linux kernel. The vblank counter callback was not holding the reset_domain semaphore, which could lead to lockdep warnings during GPU recovery. The fix involves acquiring the semaphore for reading before accessing hardware and holding it across counter and scanout-position reads. If reset is in progress, the DRM's cached software vblank count is returned instead. This change avoids blocking behind reset and prevents accessing display hardware while it is being reset.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the presence of the fix in their systems, especially those using the drm/amdgpu module.

Recommended defensive actions

• Assess exposure by checking if the system uses the drm/amdgpu module and verify the presence of the fix.
• Review the Linux kernel version and update to a version that includes the fix.
• Monitor system logs for any lockdep warnings related to the drm/amdgpu module.
• Verify the fix is included in Linux kernel packages for Linux distribution maintainers.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution. Multiple source references from the Linux kernel Git repository are available. Defenders should verify the presence of the fix in their Linux kernel versions, especially those using the drm/amdgpu module, and monitor system logs for any issues related to the drm/amdgpu module. The fix involves acquiring the reset semaphore for reading before accessing hardware and holding it across counter and scanout-position reads. If reset is in progress, the DRM'

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.