CVE-2026-72095

CVE CVE-2026-72095EUVD EUVD-2026-59053Published 2026-08-15T05:52:41.000ZLast changed 2026-08-17T05:40:12.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma_fence_dedup_array() robust against 0-count input dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output. The caller __dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path and so is save. But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 575ec9b0c2f11f40535ea737ed5a64792780d1ef <e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051; patch: 0; 575ec9b0c2f11f40535ea737ed5a64792780d1ef <77a9298741f8f9e8b963c977f5582ab21c6d3427; patch: 7.1.5; 575ec9b0c2f11f40535ea737ed5a64792780d1ef <7aa8f3dba53422465dbe1be8dbb7240304462bb2; patch: 6.18.40; 6.16; patch: 7.2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.