CVE-2026-72095

Status: UPDATED  |  Advisory ID: CVE-2026-72095

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

dma-fence: Make dma_fence_dedup_array() robust against 0-count input

dma_fence_dedup_array() returns 1 when called with num_fences == 0:

the for-loop body never executes, j stays at 0, and the final

`return ++j` yields 1. This contradicts both the kernel-doc ("Return:

Number of unique fences remaining in the array") and the natural

expectation that 0 input gives 0 output.

The caller __dma_fence_unwrap_merge() bails out via the

`if (count == 0 || count == 1)` fast path and so is save.

But amdgpu_userq_wait_*() could reach the dedup call with a zero local

count and dereference an uninitialized fence slot in the array.

Make the contract match the documentation by returning 0 early. This

also skips an unnecessary sort() call on an empty array. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References