CVE-2026-80539

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: disallow multiple FENCE chunks in one submit<br /> <br /> amdgpu_cs_pass1() dispatches on chunk_id once per chunk without<br /> rejecting repeated ids. p-&gt;uf_bo is a single-slot field, so a<br /> submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs<br /> amdgpu_cs_p1_user_fence() twice, and the second run overwrites<br /> p-&gt;uf_bo with a freshly referenced BO without dropping the reference<br /> taken by the first.<br /> <br /> amdgpu_cs_parser_fini() only unrefs the final p-&gt;uf_bo, so every FENCE<br /> chunk but the last leaks a BO reference. The leaked BO outlives handle<br /> close and process exit.<br /> <br /> Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc<br /> ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did<br /> for p-&gt;bo_list.<br /> <br /> (cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)