CVE-2026-80539 - Vulnerability Details

- drm/amdgpu: disallow multiple FENCE chunks in one submit

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: disallow multiple FENCE chunks in one submit

amdgpu_cs_pass1() dispatches on chunk_id once per chunk without
rejecting repeated ids. p->uf_bo is a single-slot field, so a
submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs
amdgpu_cs_p1_user_fence() twice, and the second run overwrites
p->uf_bo with a freshly referenced BO without dropping the reference
taken by the first.

amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE
chunk but the last leaks a BO reference. The leaked BO outlives handle
close and process exit.

Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc
("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did
for p->bo_list.

(cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)

Published: 2026-08-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The amdgpu driver processes command submissions containing multiple FENCE chunks without detecting duplicate identifiers. Each duplicate overwrites a single‑slot buffer object field and fails to release the prior reference. The result is a leaked buffer object reference that persists beyond the command submission, the handle close, and even after the process exits. This issue is classified as a resource leak under CWE-911.

Affected Systems

Any Linux system running a kernel that includes the amdgpu driver and has not yet incorporated the patch from commit 665b1fc2a1845206408f9a2c6da67101789edb82. The vulnerability affects the generic Linux kernel image, regardless of distribution.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The issue is not present in CISA’s KEV catalog. Attackers would need local access to execute graphics commands that contain duplicated FENCE chunks to trigger the leak; no remote code execution path is described. The likely attack vector is local access, inferred from the required execution of graphics commands.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d38ceaf99ed015f2a0b9af3499791bd3a3daae21`	affected	< 7e9954e7212042ec808b06181b365b14f00c6f0a
`d38ceaf99ed015f2a0b9af3499791bd3a3daae21`	affected	< 070229262ede37d17c4ea596650deb6e5eb5d106
`d38ceaf99ed015f2a0b9af3499791bd3a3daae21`	affected	< 5f46322e0b84af29e10eb951ff45bd6ea40640de
`d38ceaf99ed015f2a0b9af3499791bd3a3daae21`	affected	< 71aa45f7bfe46fbc6f51e7832573ff49b6005fea
`d38ceaf99ed015f2a0b9af3499791bd3a3daae21`	affected	< e3ee74d6dbbe409eb99546a7b0a02b2782f9021d
`d38ceaf99ed015f2a0b9af3499791bd3a3daae21`	affected	< 931cd1d1baeae68e8eb2c23bc1f3d8934dca6241

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`6.1.185`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d38ceaf99ed015f2a0b9af3499791bd3a3daae21,070229262ede37d17c4ea596650deb6e5eb5d106)`	affected	code_commit	—
`[d38ceaf99ed015f2a0b9af3499791bd3a3daae21,5f46322e0b84af29e10eb951ff45bd6ea40640de)`	affected	code_commit	—
`[d38ceaf99ed015f2a0b9af3499791bd3a3daae21,71aa45f7bfe46fbc6f51e7832573ff49b6005fea)`	affected	code_commit	—
`[d38ceaf99ed015f2a0b9af3499791bd3a3daae21,e3ee74d6dbbe409eb99546a7b0a02b2782f9021d)`	affected	code_commit	—
`[d38ceaf99ed015f2a0b9af3499791bd3a3daae21,931cd1d1baeae68e8eb2c23bc1f3d8934dca6241)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[6.6.153,6.7.0)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the amdgpu patch from commit 665b1fc2a1845206408f9a2c6da67101789edb82.
If an immediate kernel upgrade is not feasible, limit the execution of GPU‑intensive applications or disable features that generate FENCE chunks to reduce the chance of reference buildup.
Enable kernel tracing or monitor buffer object reference counts for signs of excessive GPU resource consumption on affected systems.

Generated by OpenCVE AI on August 28, 2026 at 18:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/070229262ede37d17c4ea596650deb6e5eb5d106
https://git.kernel.org/stable/c/5f46322e0b84af29e10eb951ff45bd6ea40640de
https://git.kernel.org/stable/c/71aa45f7bfe46fbc6f51e7832573ff49b6005fea
https://git.kernel.org/stable/c/7e9954e7212042ec808b06181b365b14f00c6f0a
https://git.kernel.org/stable/c/931cd1d1baeae68e8eb2c23bc1f3d8934dca6241
https://git.kernel.org/stable/c/e3ee74d6dbbe409eb99546a7b0a02b2782f9021d
https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80539-ee80@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80539
https://www.cve.org/CVERecord?id=CVE-2026-80539

History

Fri, 28 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-775

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80539-ee80@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80539 https://www.cve.org/CVERecord?id=CVE-2026-80539
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 27 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7e9954e7212042ec808b06181b365b14f00c6f0a

Wed, 26 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-775

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated ids. p->uf_bo is a single-slot field, so a submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs amdgpu_cs_p1_user_fence() twice, and the second run overwrites p->uf_bo with a freshly referenced BO without dropping the reference taken by the first. amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE chunk but the last leaks a BO reference. The leaked BO outlives handle close and process exit. Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did for p->bo_list. (cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)
Title		drm/amdgpu: disallow multiple FENCE chunks in one submit
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/070229262ede37d17c4ea596650deb6e5eb5d106 https://git.kernel.org/stable/c/5f46322e0b84af29e10eb951ff45bd6ea40640de https://git.kernel.org/stable/c/71aa45f7bfe46fbc6f51e7832573ff49b6005fea https://git.kernel.org/stable/c/931cd1d1baeae68e8eb2c23bc1f3d8934dca6241 https://git.kernel.org/stable/c/e3ee74d6dbbe409eb99546a7b0a02b2782f9021d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:13.367Z

Updated: 2026-08-27T12:40:05.835Z

Reserved: 2026-08-26T14:34:25.765Z

Link: CVE-2026-80539

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:08.133

Modified: 2026-08-27T13:18:39.113

Link: CVE-2026-80539

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80539 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T18:15:06Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object