{"id":"CVE-2026-31566","title":"drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < bc7760c107dc08ef3e231d72c492e67b0a86848b","Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < e23602eb0779760544314ed3905fa6a89a4e4070","Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 138e42be35ff2ce6572ae744de851ea286cf3c69","Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 39820864eacd886f1a6f817414fb8f9ea3e9a2b4","Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 42d248726a0837640452b71c5a202ca3d35239ec","Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 7150850146ebfa4ca998f653f264b8df6f7f85be","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:10:55.523185Z"},"published":"2026-04-24","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:15.780Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31566","references":[{"url":"https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b"},{"url":"https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070"},{"url":"https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69"},{"url":"https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4"},{"url":"https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec"},{"url":"https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02033,"ingestedAt":"2026-10-16T17:24:46.661Z","slug":"CVE-2026-31566","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)\n\n## Affected\n\n- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < bc7760c107dc08ef3e231d72c492e67b0a86848b`\n- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < e23602eb0779760544314ed3905fa6a89a4e4070`\n- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 138e42be35ff2ce6572ae744de851ea286cf3c69`\n- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 39820864eacd886f1a6f817414fb8f9ea3e9a2b4`\n- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 42d248726a0837640452b71c5a202ca3d35239ec`\n- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 7150850146ebfa4ca998f653f264b8df6f7f85be`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}