CVE-2026-31566

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-31566

Key Details

CVE	CVE-2026-31566
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-416 (Use After Free)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib

amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence

from amdgpu_ib_schedule(). This fence is used to wait for job

completion.

Currently, the code drops the fence reference using dma_fence_put()

before calling dma_fence_wait().

If dma_fence_put() releases the last reference, the fence may be

freed before dma_fence_wait() is called. This can lead to a

use-after-free.

Fix this by waiting on the fence first and releasing the reference

only after dma_fence_wait() completes.

Fixes the below:

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)

(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482) (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-31566
CVE	https://www.cve.org/CVERecord?id=CVE-2026-31566

Source

Reference

NVD

CVE