---
id: CVE-2026-63863
title: 'drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

  There is a unbalanced lock/unlock to gpusvm notifier lock:
  [  931.045868] ===================================…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f1d08a5864822684773105c60528e2abb577ca6c <
    8efaa47a871662a8c21b819cec60786f7ef17ab4
  - >-
    Linux >= f1d08a5864822684773105c60528e2abb577ca6c <
    d287dee565c3c32e1ed76ec1847af46809c29b90
  - Linux 7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:32:32.141561Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:08.711Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63863'
references:
  - url: 'https://git.kernel.org/stable/c/8efaa47a871662a8c21b819cec60786f7ef17ab4'
  - url: 'https://git.kernel.org/stable/c/d287dee565c3c32e1ed76ec1847af46809c29b90'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05341
ingestedAt: '2026-10-16T17:24:46.770Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

There is a unbalanced lock/unlock to gpusvm notifier lock:
[  931.045868] =====================================
[  931.046509] WARNING: bad unlock balance detected!
[  931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G     U
[  931.048150] -------------------------------------
[  931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:
[  931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]
[  931.050802] but there are no more locks to release!
[  931.051463]

The drm_gpusvm_notifier_unlock() sits under err_free label and the
first jump to err_free is just before calling the
drm_gpusvm_notifier_lock() causing unbalanced unlock.

## Affected

- `Linux >= f1d08a5864822684773105c60528e2abb577ca6c < 8efaa47a871662a8c21b819cec60786f7ef17ab4`
- `Linux >= f1d08a5864822684773105c60528e2abb577ca6c < d287dee565c3c32e1ed76ec1847af46809c29b90`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.