CVE-2026-99261

What it actually does

Incorrect calculation of reservation fence slots for userq per-vm BOs during eviction allows move overflow and improper fence addition, resulting in buffer overflow and potential memory corruption in the amdgpu kernel driver.

Why it matters to the business

Systems using AMD GPUs may experience kernel instability, crashes, or unauthorized code execution, leading to downtime and potential compromise of graphics workloads on affected Linux deployments.

How an attack unfolds

An attacker triggers specific buffer object eviction paths in the per-vm userq handling code by manipulating GPU memory allocations and VM mappings, causing the driver to exceed allocated fence slots and overflow into adjacent kernel structures.

How to fix it

Update the Linux kernel to a version containing the corrected reservation fence slot logic for per-vm BO eviction in the amdgpu driver.

How to confirm the fix worked

Confirm the presence of the upstream commit correcting reservation fence slots for userq per-vm BOs and verify no overflow conditions occur during eviction stress tests on AMD hardware.

Typical attack path

1. Identify target system with AMD GPU and load amdgpu driver
2. Craft sequence of per-vm BO allocations and mappings to force eviction conditions
3. Trigger move operations that exceed reserved fence slots
4. Exploit resulting overflow to corrupt kernel memory or control flow

How to detect it

Review kernel logs for amdgpu eviction errors, fence slot warnings, or related buffer management faults; correlate with GPU memory pressure events.

What your security team should do

• Prioritize kernel updates for all AMD GPU-enabled Linux systems within standard patch cycles
• Monitor for new kernel releases addressing amdgpu eviction handling
• Test graphics workloads post-update to ensure stable BO eviction behavior