Executive brief
A vulnerability in the AMD GPU driver within the Linux kernel could allow a local user to crash the system or potentially execute unauthorized code. The issue stems from how the system manages memory and synchronization 'fences' during graphics processing tasks. If exploited, this could lead to a complete system failure (kernel panic) or unauthorized access to sensitive data handled by the graphics processor.
Technical details
A use-after-free vulnerability exists in the amdgpu driver's amdgpu_gem_va_ioctl function due to improper reference counting and premature selection of DMA fences. Specifically, the driver failed to correctly manage dma_fence references when updating Virtual Address (VA) mappings and GPU timelines, leading to refcount underflows. An attacker with local access could trigger this condition to cause a kernel panic (via dma_fence_signal_timestamp_locked) or potentially achieve local privilege escalation. The fix refactors the IOCTL logic to ensure fences are chosen only after VA mapping work is complete and that references are safely balanced.
Affected products
- Linux Linux kernel 6.16 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed: CVE-2026-43237 assigned and published.
- 2026-03-04: patched: Fix committed to stable Linux kernel tree.