CVE-2026-80539

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: disallow multiple FENCE chunks in one submit

amdgpu_cs_pass1() dispatches on chunk_id once per chunk without

rejecting repeated ids. p->uf_bo is a single-slot field, so a

submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs

amdgpu_cs_p1_user_fence() twice, and the second run overwrites

p->uf_bo with a freshly referenced BO without dropping the reference

taken by the first.

amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE

chunk but the last leaks a BO reference. The leaked BO outlives handle

close and process exit.

Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc

("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did

for p->bo_list.

(cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References