---
id: CVE-2026-31566
title: 'drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib

  amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence
  from amdgpu_ib_schedule(). This fence is …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 <
    bc7760c107dc08ef3e231d72c492e67b0a86848b
  - >-
    Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 <
    e23602eb0779760544314ed3905fa6a89a4e4070
  - >-
    Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 <
    138e42be35ff2ce6572ae744de851ea286cf3c69
  - >-
    Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 <
    39820864eacd886f1a6f817414fb8f9ea3e9a2b4
  - >-
    Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 <
    42d248726a0837640452b71c5a202ca3d35239ec
  - >-
    Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 <
    7150850146ebfa4ca998f653f264b8df6f7f85be
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:10:55.523185Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:15.780Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31566'
references:
  - url: 'https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b'
  - url: 'https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070'
  - url: 'https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69'
  - url: 'https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4'
  - url: 'https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec'
  - url: 'https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02033
ingestedAt: '2026-10-16T17:24:46.661Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib

amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence
from amdgpu_ib_schedule(). This fence is used to wait for job
completion.

Currently, the code drops the fence reference using dma_fence_put()
before calling dma_fence_wait().

If dma_fence_put() releases the last reference, the fence may be
freed before dma_fence_wait() is called. This can lead to a
use-after-free.

Fix this by waiting on the fence first and releasing the reference
only after dma_fence_wait() completes.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)

(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)

## Affected

- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < bc7760c107dc08ef3e231d72c492e67b0a86848b`
- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < e23602eb0779760544314ed3905fa6a89a4e4070`
- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 138e42be35ff2ce6572ae744de851ea286cf3c69`
- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 39820864eacd886f1a6f817414fb8f9ea3e9a2b4`
- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 42d248726a0837640452b71c5a202ca3d35239ec`
- `Linux >= 9ae55f030dc523fc4dc6069557e4a887ea815453 < 7150850146ebfa4ca998f653f264b8df6f7f85be`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.