Linux Kernel EUVD-2026-55341

The drm/gpusvm subsystem in the Linux kernel DRM framework manages Shared Virtual Memory for discrete GPU drivers (such as Intel xe), enabling unified CPU-GPU address spaces backed by device page tables and IOMMU mappings. The function drm_gpusvm_get_pages() iterates over a range of pages and maps each to a device. The first successful device mapping stores a dpagemap reference locally but - before the fix - did not commit it to svm_pages->dpagemap until the entire operation succeeded. If any subsequent page in the batch failed (concretely, -EOPNOTSUPP when ctx->allow_mixed is false, preventing mixed device/system page types in a single SVM region), the code jumped to the err_unmap label. At that point, svm_pages->dpagemap was still NULL, causing __drm_gpusvm_unmap_pages() to skip device_unmap() entirely, leaving the already-mapped device pages permanently orphaned in the GPU page table. While NVD lists CWE as N/A, this is structurally a CWE-459 (Incomplete Cleanup) or CWE-772 (Missing Release of Resource after Effective Lifetime) pattern - the resource (IOMMU/device mapping) is allocated but not freed on the error path because a prerequisite pointer was never set.