CVE-2026-72095

In the Linux kernel, the following vulnerability has been resolved:

dma-fence: Make dmafencededup_array() robust against 0-count input

dmafencededuparray() returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output.

The caller _dmafenceunwrapmerge() bails out via the if (count == 0 || count == 1) fast path and so is save.

But amdgpuuserqwait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array.

Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.