PT-2026-5537 · Amd+1 · Amdgpu+1

Published 2026-01-01 · Updated 2026-01-31 · CVE-2026-23034

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:A/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the drm/amdgpu/userq subsystem related to a fence reference leak during queue teardown. The user mode queue maintains a pointer to the most recent fence, holding an extra dma fence reference. When the queue is destroyed, the driver unloads, but the last fence object can remain alive, leading to allocated objects in the amdgpu userq fence slab cache. This results in a bug during driver unload, specifically 'BUG amdgpu userq fence: Objects remaining on kmem cache shutdown()'. The issue is resolved by releasing the userq->last fence reference and clearing the pointer during amdgpu userq fence driver free().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-04128

CVE-2026-23034

Affected Products

Linux Kernel

Amdgpu

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23034.json · Exploit
• https://bdu.fstec.ru/vul/2026-04128 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23034 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23034 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23034 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23034 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23034 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23034 · Vendor Advisory
• https://t.me/CVEtracker/43394 · Telegram Post
• https://git.kernel.org/stable/c/b2426a211dba6432e32a2e70e9183c6e134475c6 · Note
• https://twitter.com/VulmonFeeds/status/2017587812267118854 · Twitter Post
• https://git.kernel.org/stable/c/e1a30e1ab33fc522785d04bbf7e1b13a5c5c9175 · Note
• https://git.kernel.org/linus/b2426a211dba6432e32a2e70e9183c6e134475c6 · Note
• https://twitter.com/CVEnew/status/2017567080468394479 · Twitter Post