CVE-2026-99119: drm/amdgpu/userq: actually validate userq BOs

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: actually validate userq BOs

This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate.

Without this, BOs that were created and evicted before a userq was made would never end up in an eviction fence rearm.

Also add the missing ref to the BO before drmexec locks and refs it.

(cherry picked from commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd)

Affected Software

1 affected component

Linux Linux kernel

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 18decfc9e8cc0fa70b6de9944cc27a37729edfbd

Oct 28, 2026

CVE Published

via MITRE·10:34 AM

Data Sourced

via MITRE·10:34 AM

Description

Deployments using the Linux kernel AMDGPU userq path are relevant when buffer objects were created and evicted before a userq was created.

Those buffer objects do not enter eviction-fence rearming because the individual evicted list was not iterated during validation.

No fixed version numbers are provided. The available references point to stable kernel commits containing the resolution.