Cloudanix VulnDB

CVE-2026-99119

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A recent fix ensures the graphics driver for AMD cards properly checks all memory buffers so that older ones are not accidentally skipped, reducing chances of system problems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing loop over the per-userq evicted BO list and absent BO reference count increment before drm_exec locking allows BOs created and evicted prior to userq creation to bypass eviction fence rearming in the amdgpu driver.

Why it matters to the business

AMD GPU systems running recent Linux kernels face elevated risk of graphics instability, potential crashes, or validation bypasses; with only three days since disclosure, immediate patching is required to limit exposure across the ecosystem.

How an attack unfolds

An attacker with local access creates buffer objects, triggers eviction, then sets up a userq so that the skipped validation path leaves fences unarmed; this can be chained with other GPU operations to influence memory handling or induce faults.

How to fix it

Apply the upstream fix (commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd) via kernel update; rebuild and reboot with a patched amdgpu module; verify the change is present in drm/amdgpu/userq.c.

How to confirm the fix worked

Confirm the patch is applied by inspecting the amdgpu/userq.c source or running a kernel with the fix; test by creating/evicting BOs before userq allocation and verifying fence rearming occurs.

Typical attack path

  1. Obtain local access on a system with AMD GPU and vulnerable amdgpu driver
  2. Allocate and evict BOs before creating a userq
  3. Trigger amdgpu_vm_validate path that omits the individual evicted list
  4. Exploit missing reference or un-rearmed fence to influence GPU memory state

How to detect it

Search kernel logs for amdgpu userq or drm_exec warnings around BO eviction; examine dmesg or journalctl for fence rearm failures or reference count anomalies on AMD GPUs.

What your security team should do

  • Immediately update Linux kernels on all AMD GPU hosts to include the referenced commit
  • Prioritize systems with high graphics workload or multi-user access
  • Monitor vendor kernel packages for backports within the next 7 days
  • Review graphics driver logs for unexpected BO or fence behavior post-update

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already handled in amdgpu_vm_validate. Without this, BOs that were created and evicted before a userq was made would never end up in an eviction fence rearm. Also add the missing ref to the BO before drm_exec locks and refs it. (cherry picked from commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd)

Affected packages

Ecosystem Package Introduced Fixed