In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the logic for managing the last update fence directly into amdgpu_gem_va_update_vm. - Introduced checks for the timeline point to enable conditional replacement or addition of fences.
v2: Addressed review comments from Christian. v3: Updated comments (Christian). v4: The previous version selected the fence too early and did not manage its reference correctly, which could lead to stale or freed fences being used. This resulted in refcount underflows and could crash when updating GPU timelines. The fence is now chosen only after the VA mapping work is completed, and its reference is taken safely. After exporting it to the VM timeline syncobj, the driver always drops its local fence reference, ensuring balanced refcounting and avoiding use-after-free on dma_fence.
Crash signature: [ 205.828135] refcount_t: underflow; use-after-free. [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... [ 206.074014] Call Trace: [ 206.076488] <TASK> [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu] [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm] [ 206.094415] drm_ioctl+0x26e/0x520 [drm] [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu] [ 206.109387] __x64_sys_ioctl+0x96/0xe0 [ 206.113156] do_syscall_64+0x66/0x2d0 ... [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90 ... [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.553405] Call Trace: [ 206.553409] <IRQ> [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched] [ 206.553424] dma_fence_signal+0x30/0x60 [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched] [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0 [ 206.553437] dma_fence_signal+0x30/0x60 [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu] [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu] [ 206.554353] edac_mce_amd(E) ee1004(E) [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu] [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu] [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu] [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0 [ 206.555506] handle_irq_event+0x38/0x80 [ 206.555509] handle_edge_irq+0x92/0x1e0 [ 206.555513] __common_interrupt+0x3e/0xb0 [ 206.555519] common_interrupt+0x80/0xa0 [ 206.555525] </IRQ> [ 206.555527] <TASK> ... [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-uki-virtUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-rt-64k-debug-develUpgrade kernel-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-coreUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-extraUpgrade kernel-64k-develUpgrade kernel-rt-64kUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-64kUpgrade kernel-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debugUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libsUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-coreUpgrade rvUpgrade kernel-zfcpdumpUpgrade kernelUpgrade kernel-coreUpgrade kernel-debug-modules-coreUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade libperfUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade rtlaUpgrade kernel-rt-develUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-modules | Oct 11, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 4, 2026 | May 6, 2026 |
| Rocky_linux | — | Upgrade kernel-rt-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modulesUpgrade rvUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-toolsUpgrade libperf-debuginfoUpgrade kernel-rt-develUpgrade kernel-coreUpgrade perf-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-uki-virtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rtUpgrade perfUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-coreUpgrade kernel-develUpgrade rtlaUpgrade python3-perfUpgrade kernel-zfcpdump-develUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-develUpgrade kernel-zfcpdump-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debug-modules | Aug 24, 2026 | Aug 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub