CVE-2026-23034

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: Fix fence reference leak on queue teardown v2

The user mode queue keeps a pointer to the most recent fence in

userq->last_fence. This pointer holds an extra dma_fence reference.

When the queue is destroyed, we free the fence driver and its xarray,

but we forgot to drop the last_fence reference.

Because of the missing dma_fence_put(), the last fence object can stay

alive when the driver unloads. This leaves an allocated object in the

amdgpu_userq_fence slab cache and triggers

This is visible during driver unload as:

BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()

kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects

Call Trace:

kmem_cache_destroy

amdgpu_userq_fence_slab_fini

amdgpu_exit

__do_sys_delete_module

Fix this by putting userq->last_fence and clearing the pointer during

amdgpu_userq_fence_driver_free().

This makes sure the fence r

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References