CVE-2026-23034: drm/amdgpu/userq: Fix fence reference leak on queue teardown v2
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: Fix fence reference leak on queue teardown v2
The user mode queue keeps a pointer to the most recent fence in userq->lastfence. This pointer holds an extra dmafence reference.
When the queue is destroyed, we free the fence driver and its xarray, but we forgot to drop the lastfence reference.
Because of the missing dmafenceput(), the last fence object can stay alive when the driver unloads. This leaves an allocated object in the amdgpuuserqfence slab cache and triggers
This is visible during driver unload as:
BUG amdgpuuserqfence: Objects remaining on kmemcacheshutdown() kmemcachedestroy amdgpuuserqfence: Slab cache still has objects Call Trace: kmemcachedestroy amdgpuuserqfenceslabfini amdgpuexit dosysdeletemodule
Fix this by putting userq->lastfence and clearing the pointer during amdgpuuserqfencedriverfree().
This makes sure the fence reference is released and the slab cache is empty when the module exits.
v2: Update to only release userq->lastfence with dmafenceput() (Christian)
(cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 8e051e38a8d45caf6a866d4ff842105b577953bb
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23034?
CVE-2026-23034 is classified as a low severity vulnerability.
What systems are affected by CVE-2026-23034?
CVE-2026-23034 affects the Linux Kernel, specifically within the AMD GPU driver.
How do I fix CVE-2026-23034?
To address CVE-2026-23034, ensure you update your Linux Kernel to the latest version that includes the patch.
What does CVE-2026-23034 exploit?
CVE-2026-23034 exploits a fence reference leak during queue teardown in the AMD GPU driver.
Is CVE-2026-23034 easy to exploit?
Exploitation of CVE-2026-23034 requires specific conditions and knowledge of the system, making it less accessible to casual attackers.