CVE-2026-23034

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23034", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.942Z", "datePublished": "2026-01-31T11:42:29.137Z", "dateUpdated": "2026-05-11T21:58:43.438Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:43.438Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/userq: Fix fence reference leak on queue teardown v2\n\nThe user mode queue keeps a pointer to the most recent fence in\nuserq->last_fence. This pointer holds an extra dma_fence reference.\n\nWhen the queue is destroyed, we free the fence driver and its xarray,\nbut we forgot to drop the last_fence reference.\n\nBecause of the missing dma_fence_put(), the last fence object can stay\nalive when the driver unloads. This leaves an allocated object in the\namdgpu_userq_fence slab cache and triggers\n\nThis is visible during driver unload as:\n\n BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()\n kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects\n Call Trace:\n kmem_cache_destroy\n amdgpu_userq_fence_slab_fini\n amdgpu_exit\n __do_sys_delete_module\n\nFix this by putting userq->last_fence and clearing the pointer during\namdgpu_userq_fence_driver_free().\n\nThis makes sure the fence reference is released and the slab cache is\nempty when the module exits.\n\nv2: Update to only release userq->last_fence with dma_fence_put()\n (Christian)\n\n(cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c"], "versions": [{"version": "edc762a51c7181d6fe1e0837e2eb69afb406f98e", "lessThan": "e1a30e1ab33fc522785d04bbf7e1b13a5c5c9175", "status": "affected", "versionType": "git"}, {"version": "edc762a51c7181d6fe1e0837e2eb69afb406f98e", "lessThan": "b2426a211dba6432e32a2e70e9183c6e134475c6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e1a30e1ab33fc522785d04bbf7e1b13a5c5c9175"}, {"url": "https://git.kernel.org/stable/c/b2426a211dba6432e32a2e70e9183c6e134475c6"}], "title": "drm/amdgpu/userq: Fix fence reference leak on queue teardown v2", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e1a30e1ab33fc522785d04bbf7e1b13a5c5c9175", "status": "affected", "version": "edc762a51c7181d6fe1e0837e2eb69afb406f98e", "versionType": "git"}, {"lessThan": "b2426a211dba6432e32a2e70e9183c6e134475c6", "status": "affected", "version": "edc762a51c7181d6fe1e0837e2eb69afb406f98e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/userq: Fix fence reference leak on queue teardown v2\n\nThe user mode queue keeps a pointer to the most recent fence in\nuserq->last_fence. This pointer holds an extra dma_fence reference.\n\nWhen the queue is destroyed, we free the fence driver and its xarray,\nbut we forgot to drop the last_fence reference.\n\nBecause of the missing dma_fence_put(), the last fence object can stay\nalive when the driver unloads. This leaves an allocated object in the\namdgpu_userq_fence slab cache and triggers\n\nThis is visible during driver unload as:\n\n BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()\n kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects\n Call Trace:\n kmem_cache_destroy\n amdgpu_userq_fence_slab_fini\n amdgpu_exit\n __do_sys_delete_module\n\nFix this by putting userq->last_fence and clearing the pointer during\namdgpu_userq_fence_driver_free().\n\nThis makes sure the fence reference is released and the slab cache is\nempty when the module exits.\n\nv2: Update to only release userq->last_fence with dma_fence_put()\n (Christian)\n\n(cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu/userq: Soluci\u00f3n a la fuga de referencia de 'fence' durante el desmontaje de la cola v2\n\nLa cola en modo usuario mantiene un puntero al 'fence' m\u00e1s reciente en userq->last_fence. Este puntero mantiene una referencia extra de dma_fence.\n\nCuando la cola es destruida, liberamos el controlador de 'fence' y su xarray, pero olvidamos liberar la referencia de last_fence.\n\nDebido a la ausencia de dma_fence_put(), el \u00faltimo objeto 'fence' puede permanecer activo cuando el controlador se descarga. Esto deja un objeto asignado en la cach\u00e9 de 'slab' amdgpu_userq_fence y desencadena\n\nEsto es visible durante la descarga del controlador como:\n\n BUG amdgpu_userq_fence: Objetos restantes en __kmem_cache_shutdown()\n kmem_cache_destroy amdgpu_userq_fence: La cach\u00e9 de 'slab' todav\u00eda tiene objetos\n Traza de Llamada:\n kmem_cache_destroy\n amdgpu_userq_fence_slab_fini\n amdgpu_exit\n __do_sys_delete_module\n\nSolucione esto liberando userq->last_fence y limpiando el puntero durante amdgpu_userq_fence_driver_free().\n\nEsto asegura que la referencia de 'fence' sea liberada y que la cach\u00e9 de 'slab' est\u00e9 vac\u00eda cuando el m\u00f3dulo sale.\n\nv2: Actualizaci\u00f3n para liberar solo userq->last_fence con dma_fence_put() (Christian)\n\n(seleccionado del commit 8e051e38a8d45caf6a866d4ff842105b577953bb)"}], "id": "CVE-2026-23034", "lastModified": "2026-06-17T10:20:44.953", "metrics": {}, "published": "2026-01-31T12:16:06.710", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2426a211dba6432e32a2e70e9183c6e134475c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e1a30e1ab33fc522785d04bbf7e1b13a5c5c9175"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/amdgpu/userq: Fix fence reference leak on queue teardown v2", "id": "2435641", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435641"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu/userq: Fix fence reference leak on queue teardown v2\nThe user mode queue keeps a pointer to the most recent fence in\nuserq->last_fence. This pointer holds an extra dma_fence reference.\nWhen the queue is destroyed, we free the fence driver and its xarray,\nbut we forgot to drop the last_fence reference.\nBecause of the missing dma_fence_put(), the last fence object can stay\nalive when the driver unloads. This leaves an allocated object in the\namdgpu_userq_fence slab cache and triggers\nThis is visible during driver unload as:\nBUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()\nkmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects\nCall Trace:\nkmem_cache_destroy\namdgpu_userq_fence_slab_fini\namdgpu_exit\n__do_sys_delete_module\nFix this by putting userq->last_fence and clearing the pointer during\namdgpu_userq_fence_driver_free().\nThis makes sure the fence reference is released and the slab cache is\nempty when the module exits.\nv2: Update to only release userq->last_fence with dma_fence_put()\n(Christian)\n(cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)"], "name": "CVE-2026-23034", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23034\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23034\nhttps://lore.kernel.org/linux-cve-announce/2026013121-CVE-2026-23034-9a60@gregkh/T"]}

{"analysis": {"en": {"generated_at": "2026-04-18T18:36:54.149011+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that contains the AMDGPU user queue fence reference leak fix (commit 8e051e38a8d45caf6a866d4ff842105b577953bb).", "If a kernel update cannot be performed immediately, avoid unloading or reloading the AMDGPU driver until the system is patched.", "Monitor kernel logs for \"amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()\" and review slab cache usage for residual objects to ensure the leak has been fully mitigated."], "summary": {"action": "Immediate Patch", "impact": "Resource Exhaustion"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the AMDGPU driver and execute the user queue teardown path are affected. Versions of the kernel prior to the fix (commit 8e051e38a8d45caf6a866d4ff842105b577953bb) are vulnerable. No specific version numbers are provided, but the issue exists in kernels containing the corresponding code before the update.", "description_and_impact": "The AMDGPU driver in the Linux kernel contains a memory leak that occurs when a user queue is torn down. A reference to the most recent fence is retained in userq->last_fence and is not released during module unload. Because of the missing dma_fence_put() call, the last fence object can remain allocated, leaving objects in the amdgpu_userq_fence slab cache. This leak can lead to kernel memory waste and may trigger a BUG during driver unload as reported in the kernel log.", "risk_and_exploitability": "The EPSS score is below 1%, indicating a very low probability that this flaw is actively exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local kernel access and the ability to unload or reload the AMDGPU module, a scenario unlikely to be targeted by attackers. Consequently, the overall risk is low, and the flaw is unlikely to be leveraged in a real-world attack."}}}}, "created": "2026-04-18T18:45:05.754619+00:00", "updated": "2026-04-18T18:45:05.754630+00:00", "vendors": [], "weaknesses": ["CWE-404"]}