AZL-97749
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97749.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-97749
- Upstream
- Published
- 2026-08-26T15:17:08Z
- Modified
- 2026-08-29T05:27:27Z
- Summary
- CVE-2026-80539 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: disallow multiple FENCE chunks in one submit
amdgpucspass1() dispatches on chunkid once per chunk without rejecting repeated ids. p->ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks runs amdgpucsp1userfence() twice, and the second run overwrites p->ufbo with a freshly referenced BO without dropping the reference taken by the first.
amdgpucsparserfini() only unrefs the final p->ufbo, so every FENCE chunk but the last leaks a BO reference. The leaked BO outlives handle close and process exit.
Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc ("drm/amdgpu: disallow multiple BOHANDLES chunks in one submit") did for p->bolist.
(cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)
- References