---
id: CVE-2026-43370
title: 'drm/amdgpu: Fix use-after-free race in VM acquire'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: Fix use-after-free race in VM acquire

  Replace non-atomic vm->process_info assignment with cmpxchg()
  to prevent race when parent/child processes sharing a d…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    ae87aea330c24f462fc7058ed543ba8bc6798447
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    46d309996bd9251792d7dafdbaf615cf202b4447
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    e61e355cbe49e585097eee28c15b862bfb1c0668
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    c658c1c85ec235b7ecfbf8dbfee385b1332088f4
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    904025fa8bba1d028adade33346372b4ac1a9249
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    7885eb335d8f9e9942925d57e300a85e3f82ded4
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    94b7782d0c8024f5b88454241c8d4777076c3786
  - >-
    Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad <
    2c1030f2e84885cc58bffef6af67d5b9d2e7098f
  - Linux 4.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:16:53.007366Z'
published: '2026-05-08'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:40.381Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43370'
references:
  - url: 'https://git.kernel.org/stable/c/ae87aea330c24f462fc7058ed543ba8bc6798447'
  - url: 'https://git.kernel.org/stable/c/46d309996bd9251792d7dafdbaf615cf202b4447'
  - url: 'https://git.kernel.org/stable/c/e61e355cbe49e585097eee28c15b862bfb1c0668'
  - url: 'https://git.kernel.org/stable/c/c658c1c85ec235b7ecfbf8dbfee385b1332088f4'
  - url: 'https://git.kernel.org/stable/c/904025fa8bba1d028adade33346372b4ac1a9249'
  - url: 'https://git.kernel.org/stable/c/7885eb335d8f9e9942925d57e300a85e3f82ded4'
  - url: 'https://git.kernel.org/stable/c/94b7782d0c8024f5b88454241c8d4777076c3786'
  - url: 'https://git.kernel.org/stable/c/2c1030f2e84885cc58bffef6af67d5b9d2e7098f'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02059
ingestedAt: '2026-10-16T17:24:46.693Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix use-after-free race in VM acquire

Replace non-atomic vm->process_info assignment with cmpxchg()
to prevent race when parent/child processes sharing a drm_file
both try to acquire the same VM after fork().

(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)

## Affected

- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < ae87aea330c24f462fc7058ed543ba8bc6798447`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < 46d309996bd9251792d7dafdbaf615cf202b4447`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < e61e355cbe49e585097eee28c15b862bfb1c0668`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < c658c1c85ec235b7ecfbf8dbfee385b1332088f4`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < 904025fa8bba1d028adade33346372b4ac1a9249`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < 7885eb335d8f9e9942925d57e300a85e3f82ded4`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < 94b7782d0c8024f5b88454241c8d4777076c3786`
- `Linux >= ede0dd86f45adf2b7083bb161f6bc81da5fe2bad < 2c1030f2e84885cc58bffef6af67d5b9d2e7098f`
- `Linux 4.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.