{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.11-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/imagination: Fix reference and vm_bo handling in remap()  When a map overlaps part of an existing mapping, pvr_vm_gpuva_remap() splits the mapping into prev/next parts covering what the request did not take, instead of creating something new. It gets two things wrong.  - A GEM reference is taken for each part but it's never needed and never   dropped, so it leaks one reference per split (remap-next-in-2m in   tests/imagination/pvr_vm_map.c):      CRITICAL: 33558528 bytes of shmem still held after close  - The parts still belong to the original object being split, but   pvr_vm_gpuva_remap() links them to ctx-\u003egpuvm_bo, the new object's   vm_bo:      prev_va --obj--\u003e BO_A          BO_B \u003c--obj-- vm_bo (ctx-\u003egpuvm_bo)             \\___________link___________/  (mismatch: BO_A != BO_B)    drm_gpuva_link() catches the mismatch:      WARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310       drm_WARN_ON(obj != vm_bo-\u003eobj)     Call trace:      drm_gpuva_link      pvr_vm_gpuva_remap      __drm_gpuvm_sm_map      pvr_vm_map      pvr_ioctl_vm_map    Link them to op-\u003eremap.unmap-\u003eva-\u003evm_bo instead.  The locking of the GPUVA lists of the other objects touched by a split is not addressed here; it is handled by switching the GPUVM to immediate mode.",
  "id": "DEBIAN-CVE-2026-98949",
  "modified": "2026-10-24T05:47:38.952216347Z",
  "published": "2026-10-23T13:17:16.037Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98949"
    }
  ],
  "upstream": [
    "CVE-2026-98949"
  ]
}