CVE-2026-99261

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99261", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.404Z", "datePublished": "2026-11-03T11:25:15.605Z", "dateUpdated": "2026-11-03T19:13:15.613Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-03T19:13:15.613Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\n\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"], "versions": [{"version": "897ee11ec0209aa90184b5a69d0e172d007dce3a", "lessThan": "76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc", "status": "affected", "versionType": "git"}, {"version": "897ee11ec0209aa90184b5a69d0e172d007dce3a", "lessThan": "50b24a20be8c0d35f89f7d5c39533f69d84fe48e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc"}, {"url": "https://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e"}], "title": "drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc", "status": "affected", "version": "897ee11ec0209aa90184b5a69d0e172d007dce3a", "versionType": "git"}, {"lessThan": "50b24a20be8c0d35f89f7d5c39533f69d84fe48e", "status": "affected", "version": "897ee11ec0209aa90184b5a69d0e172d007dce3a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\n\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs."}], "id": "CVE-2026-99261", "lastModified": "2026-11-03T19:18:16.147", "metrics": {}, "published": "2026-11-03T12:17:33.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction", "id": "2565718", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565718"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs.", "A flaw was found in the Linux kernel's AMD GPU driver (amdgpu). When managing memory for user queues, the driver reserves an insufficient number of synchronization fence slots during buffer object eviction. A local user can exploit this vulnerability to trigger a kernel crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-99261", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-03T11:25:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99261\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99261\nhttps://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e\nhttps://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires local system access on hosts equipped with AMD graphics hardware, significantly limiting exposure. An unprivileged or local attacker triggering this flaw can induce a kernel crash leading to a denial of service, with no direct path to arbitrary code execution or unauthorized data access. Furthermore, the affected user queue features are not present or active in the standard configurations of supported enterprise releases.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,50b24a20be8c0d35f89f7d5c39533f69d84fe48e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.13,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,50b24a20be8c0d35f89f7d5c39533f69d84fe48e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.13,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-03T13:00:10.231117+00:00", "updated": "2026-11-07T03:30:13.077624+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}