{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31566", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.117Z", "datePublished": "2026-04-24T14:35:46.740Z", "dateUpdated": "2026-08-05T12:23:32.865Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:32.865Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable `amdgpu_amdkfd_submit_ib()` path is reached from local userspace through `/dev/kfd` and AMDGPU/KFD queue ioctls, not through network, adjacent, or physical input.\nAC:L - On an affected AMDGPU KFD/NO_HWS Hawaii deployment, an attacker can drive the queue create/destroy path and repeatedly trigger the fence lifetime bug without relying on victim-controlled timing. When uncertain, the lower-complexity option is appropriate.\nPR:L - The path requires local access to the KFD/AMDGPU device interfaces and a render/DRM VM FD, but no kernel administrative capability is checked by the relevant KFD queue ioctls. This is ordinary low-privileged local GPU access rather than real root.\nUI:N - After obtaining local device access, the attacker can issue the ioctl sequence themselves. No separate victim action is required.\nS:U - The impact is within the same kernel security authority: corrupting or crashing kernel/driver state from a local kernel attack surface. It does not cross a VM, IOMMU, or comparable security boundary.\nC:H - The bug is a use-after-free of a `dma_fence`/AMDGPU fence object used by `dma_fence_wait()`. Per kernel scoring guidance, UAF memory corruption can be leveraged for high confidentiality impact.\nI:H - The same UAF exposes kernel object lifetime corruption in a wait path using function pointers, locks, callbacks, and list state. Per guidance, UAF memory corruption is scored as high integrity impact.\nA:H - Even without full exploitation, using a freed fence in `dma_fence_wait()` can cause kernel warnings, crashes, hangs, or panics. A kernel UAF therefore has high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c" ], "versions": [ { "version": "9ae55f030dc523fc4dc6069557e4a887ea815453", "lessThan": "bc7760c107dc08ef3e231d72c492e67b0a86848b", "status": "affected", "versionType": "git" }, { "version": "9ae55f030dc523fc4dc6069557e4a887ea815453", "lessThan": "e23602eb0779760544314ed3905fa6a89a4e4070", "status": "affected", "versionType": "git" }, { "version": "9ae55f030dc523fc4dc6069557e4a887ea815453", "lessThan": "138e42be35ff2ce6572ae744de851ea286cf3c69", "status": "affected", "versionType": "git" }, { "version": "9ae55f030dc523fc4dc6069557e4a887ea815453", "lessThan": "39820864eacd886f1a6f817414fb8f9ea3e9a2b4", "status": "affected", "versionType": "git" }, { "version": "9ae55f030dc523fc4dc6069557e4a887ea815453", "lessThan": "42d248726a0837640452b71c5a202ca3d35239ec", "status": "affected", "versionType": "git" }, { "version": "9ae55f030dc523fc4dc6069557e4a887ea815453", "lessThan": "7150850146ebfa4ca998f653f264b8df6f7f85be", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.19.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b" }, { "url": "https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070" }, { "url": "https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69" }, { "url": "https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4" }, { "url": "https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec" }, { "url": "https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be" } ], "title": "drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib", "x_generator": { "engine": "bippy-1.2.0" } } } }