Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99261— drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： drm/amdgpu：修正用于用户队列（userq）每虚拟机（per-vm）缓冲对象（BO）驱逐的保留栅栏（reservation fence）槽位。 该修复解决了在驱逐这些每虚拟机缓冲对象时出现的移动溢出问题，以及驱逐栅栏添加问题。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux 897ee11ec0209aa90184b5a69d0e172d007dce3a< 76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc affected
897ee11ec0209aa90184b5a69d0e172d007dce3a< 50b24a20be8c0d35f89f7d5c39533f69d84fe48e affected
7.2 affected
< 7.2 unaffected
7.2.13≤ 7.2.* unaffected
7.3≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99261

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 897ee11ec0209aa90184b5a69d0e172d007dce3a ~ 76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc -
Linux Linux 7.2 -

II. Public POCs for CVE-2026-99261

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99261

请登录查看更多情报信息。

Other References for CVE-2026-99261 (2)

Same Patch Batch · Linux · 2026-11-03 · 19 CVEs total

CVE-2026-99270 8.1 HIGH tcp: Fix potential UAF in reqsk_timer_handler().
CVE-2026-99246 8.1 HIGH tipc: protect node reset trace dump with node lock
CVE-2026-99269 7.8 HIGH sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99254 io_uring: don't flood a cancelling task with task_work
CVE-2026-99259 soc/tegra: pmc: Fix uninitialised clock rate
CVE-2026-99258 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
CVE-2026-99260 ntfs: fix resident conversion in ntfs_new_attr_flags
CVE-2026-99257 gpio: shared: gracefully handle no-device lookup of shared GPIOs
CVE-2026-99256 dm cache: fix issue with background work locking
CVE-2026-99255 io_uring/io-wq: don't hide a link from cancellations
CVE-2026-99244 pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
CVE-2026-99253 io_uring/cancel: rearm local work wake up before sleep
CVE-2026-99249 pid_namespace: make zap_pid_ns_processes() freezable
CVE-2026-99250 printk: Postpone kthread startup
CVE-2026-99251 Drivers: hv: Avoid infinite retry loop in init_vp_index()
CVE-2026-99248 i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
CVE-2026-99247 tracing: Do not initialize tracefs work if tracing is disabled
CVE-2026-99245 KEYS: Fix key_reject_and_link() race with keyring restriction

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux