PT-2026-37577 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-43237

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the amdgpu gem va ioctl function where the fence was selected too early and its reference was not managed correctly. This leads to refcount underflows and the use of stale or freed fences, resulting in a use-after-free condition on dma fence. This flaw can cause the system to crash or trigger a kernel panic when updating GPU timelines.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-43237

Affected Products

Linux Kernel

References · 11

• https://cve.org/CVERecord?id=CVE-2026-43237 · Security Note
• https://git.kernel.org/stable/c/e9e477d3197f7d8955a042c0d7f53f78f13218ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43237 · Security Note
• https://git.kernel.org/stable/c/bd8150a1b3370a9f7761c5814202a3fe5a79f44f · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43237 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43237 · Vendor Advisory
• https://git.kernel.org/stable/c/0399b8416ecf64ef86ad23401fe23eabdb07831a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43237 · Vendor Advisory
• https://git.kernel.org/linus/bd8150a1b3370a9f7761c5814202a3fe5a79f44f · Note
• https://twitter.com/windowsforum/status/2052320113508991391 · Twitter Post