Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver. The issue occurs when the system handles specific requests to wait for graphics tasks to complete; if the request fails due to a small data buffer, the system fails to properly release internal resources. This can lead to a resource leak that may eventually cause system instability or a denial of service.
Technical details
A reference leak exists in the amdgpu_userq_wait_ioctl function within the AMDGPU driver (drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c). The vulnerability is triggered when the ioctl is aborted because the output array provided by the user is too small. In this error path, the code fails to call dma_fence_put() for syncobj and timeline fences, leading to a reference count leak. A local attacker with access to the GPU device can exploit this to exhaust kernel memory or reference counts, leading to a denial of service. Patches have been released for various stable branches including 6.18.19 and 6.19.9.
Affected products
- Linux Linux Kernel 6.16 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory