CVE-2026-72095

Received Received - Intake

DMA Fence Zero-Count Input Handling Fix in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma_fence_dedup_array() robust against 0-count input dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output. The caller __dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path and so is save. But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72095

EUVD

EUVD-2026-59053

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the function dma_fence_dedup_array() incorrectly returns 1 when given zero input fences instead of returning 0 as documented. This mismatch between behavior and documentation could lead to issues in functions like amdgpu_userq_wait_*() that might dereference uninitialized memory when processing zero-length arrays.

Detection Guidance

This vulnerability is specific to the Linux kernel's dma-fence subsystem and requires kernel-level inspection. Detection involves checking kernel logs for errors related to dma_fence_dedup_array() or amdgpu_userq_wait_*() functions. Use commands like dmesg | grep dma_fence or journalctl -k | grep dma_fence to search for relevant errors.

Impact Analysis

The impact is limited to systems using affected Linux kernel components. It could cause crashes or undefined behavior in graphics processing (AMD GPU) when handling zero-length fence arrays. Most users would only notice system instability in rare edge cases.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue related to fence handling in the Linux DMA subsystem. It does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this vulnerability. If immediate patching is not possible, monitor kernel logs for related errors and avoid using affected AMD GPU operations until patched.

Hi! I’m here to help you understand CVE-2026-72095. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70