Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver that could allow for improper memory access. This issue occurs when the system handles graphics queue creation, potentially allowing a user to access memory that has already been unmapped or reassigned. If exploited, this could lead to system instability or unauthorized access to sensitive graphics data.
Technical details
A race condition exists in the amdgpu driver's user queue (userq) implementation within `mes_userqueue.c`. The vulnerability stems from improper locking when accessing write pointer (wptr) mappings. Specifically, the code failed to simultaneously lock both the VM root buffer object (bo) and the wptr_obj bo, allowing a security issue where the wptr_obj could be unmapped while queue creation is still in progress. An attacker could potentially pass a different buffer object at the same address during this window. The fix implements `drm_exec` to ensure both necessary locks are held during the mapping data access.
Affected products
- Linux Linux Kernel 6.10, 6.9, 6.6, 6.1, 5.15, 5.10, 5.4, 4.19
Timeline
- 2026-05-04: other: Patch authored by Sunil Khatri
- 2026-06-08: advisory: CVE-2026-46311 published by NVD