CVE-2026-43237
Refcount Underflow in AMDGPU Kernel Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amd | amdgpu | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's amdgpu driver, specifically in the function amdgpu_gem_va_ioctl which manages GPU memory and synchronization fences.
The issue was caused by selecting and managing a fence reference too early, which led to reference count underflows and use-after-free errors. This means that the system could attempt to use a fence object that had already been freed, causing crashes or kernel panics.
The vulnerability manifests as a crash or kernel panic due to improper handling of GPU timeline fences, resulting in errors like refcount underflow and fatal exceptions during interrupts.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash or panic when handling GPU operations, leading to system instability or denial of service.
If exploited or triggered, it could disrupt normal GPU functionality, potentially causing applications relying on GPU acceleration to fail or the entire system to become unresponsive.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific crash signatures related to the amdgpu driver. Look for kernel messages indicating refcount underflow or use-after-free errors, such as:
- refcount_t: underflow; use-after-free.
- WARNING: CPU: ... at lib/refcount.c:28 refcount_warn_saturate
- Call traces involving amdgpu_gem_va_ioctl and dma_fence_signal_timestamp_locked
You can use commands like 'dmesg' or 'journalctl -k' to check for these kernel messages. For example:
- dmesg | grep -i 'refcount_t: underflow'
- journalctl -k | grep -i 'use-after-free'
- journalctl -k | grep -i 'amdgpu_gem_va_ioctl'
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Linux kernel to a version that contains the fix for this vulnerability. The fix involves refactoring the amdgpu_gem_va_ioctl function to properly manage fence references and avoid use-after-free conditions.
Until the update is applied, monitor system logs for crash signatures and consider limiting or disabling workloads that heavily use the amdgpu driver to reduce the risk of triggering the vulnerability.