Look up another CVE · open CVE-2026-72095 in the interactive tracker
CVE-2026-72095
dma-fence: Make dma_fence_dedup_array() robust against 0-count input
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/dma-buf. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72095 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output. The caller __dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path and so is save. But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/dma-buf/dma-fence-unwrap.c
- What this is
- SYNC FILE FRAMEWORKMAINTAINERS section matched on drivers/dma-buf/dma-fence* · linux-media@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_DMA_SHARED_BUFFER /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_DMA_SHARED_BUFFER
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/dma-buf
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.16 | 6.18.40 | 7aa8f3dba534 |
| 6.16 | 7.1.5 | e2d9a2ea178a |
| 6.16 | 7.2 | 77a9298741f8 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only via the AMDGPU_USERQ_WAIT DRM ioctl on /dev/dri/renderD*, requiring local access to an AMD GPU render node; it is not reachable from network protocols or remote packet handling.
- AC:LAttack complexity, low
- An attacker with render-node access can reliably trigger the bug by creating a userq, calling AMDGPU_USERQ_WAIT with num_fences>0 and zero syncobj/BO handles so local num_fences stays 0 and dma_fence_dedup_array() incorrectly returns 1.
- PR:LPrivileges required, low
- Exploitation requires only an authenticated DRM client on a render node (DRM_AUTH|DRM_RENDER_ALLOW), which unprivileged users commonly obtain via the render group on workstations, cloud GPU instances, and shared compute nodes.
- UI:NUser interaction, none
- No victim interaction is required; the attacker drives the vulnerable AMDGPU_USERQ_WAIT ioctl directly after creating their own user queue.
- S:UScope, unchanged
- Impact remains within the host kernel security domain (local privilege escalation/DoS on the GPU server); it does not cross VM, container, or IOMMU boundaries.
- C:HConfidentiality impact, high
- When num_fences is 0 the dedup helper returns 1, causing iteration over uninitialized kmalloc slots whose stale contents are then dereferenced via to_amdgpu_userq_fence()/dma_fence_wait(), enabling kernel memory reads and pointer disclosure.
- I:HIntegrity impact, high
- The uninitialized fences[0] pointer is passed into dma_fence_enable_sw_signaling() and dma_fence_wait(), which invoke fence ops and locking on attacker-influenced addresses, creating a plausible path to control-flow hijacking via heap grooming.
- A:HAvailability impact, high
- Dereferencing an uninitialized or attacker-influenced dma_fence pointer in kernel context can cause an oops, BUG, or panic, producing a repeatable local denial of service on affected AMDGPU userq systems.