<Vulnerability name="CVE-2026-99261">
    <DocumentDistribution xml:lang="en">Copyright © 2012 Red Hat, Inc. All rights reserved.</DocumentDistribution>
    <ThreatSeverity>Moderate</ThreatSeverity>
    <PublicDate>2026-11-03T11:25:15</PublicDate>
    <Bugzilla id="2565718" url="https://bugzilla.redhat.com/show_bug.cgi?id=2565718" xml:lang="en:us">
kernel: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
    </Bugzilla>
    <CVSS3 status="draft">
        <CVSS3BaseScore>5.5</CVSS3BaseScore>
        <CVSS3ScoringVector>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</CVSS3ScoringVector>
    </CVSS3>
    <CWE>CWE-787</CWE>
    <Details xml:lang="en:us" source="Mitre">
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction

It fixes both the move overflow and the eviction fence add for
evicting these per-vm BOs.
    </Details>
    <Details xml:lang="en:us" source="Red Hat">
A flaw was found in the Linux kernel's AMD GPU driver (amdgpu). When managing memory for user queues, the driver reserves an insufficient number of synchronization fence slots during buffer object eviction. A local user can exploit this vulnerability to trigger a kernel crash, resulting in a Denial of Service (DoS).
    </Details>
    <Statement xml:lang="en:us">
This vulnerability is rated as Moderate severity because exploitation requires local system access on hosts equipped with AMD graphics hardware, significantly limiting exposure. An unprivileged or local attacker triggering this flaw can induce a kernel crash leading to a denial of service, with no direct path to arbitrary code execution or unauthorized data access. Furthermore, the affected user queue features are not present or active in the standard configurations of supported enterprise releases.
    </Statement>
    <PackageState cpe="cpe:/a:redhat:enterprise_linux:10">
        <ProductName>Red Hat Enterprise Linux 10</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:rhel_els:6">
        <ProductName>Red Hat Enterprise Linux 6</ProductName>
        <FixState>Out of support scope</FixState>
        <PackageName>kernel</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:rhel_els:7">
        <ProductName>Red Hat Enterprise Linux 7</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/o:redhat:rhel_els:7">
        <ProductName>Red Hat Enterprise Linux 7</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel-rt</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:enterprise_linux:8">
        <ProductName>Red Hat Enterprise Linux 8</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:enterprise_linux:8">
        <ProductName>Red Hat Enterprise Linux 8</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel-rt</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:enterprise_linux:9">
        <ProductName>Red Hat Enterprise Linux 9</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:enterprise_linux:9">
        <ProductName>Red Hat Enterprise Linux 9</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>kernel-rt</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:openshift:4">
        <ProductName>Red Hat OpenShift Container Platform 4</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>openshift/ose-rhel-coreos-8</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:openshift:4">
        <ProductName>Red Hat OpenShift Container Platform 4</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>openshift/ose-rhel-coreos-9</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:openshift:5">
        <ProductName>Red Hat OpenShift Container Platform 5</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>openshift/ose-rhel-coreos-10</PackageName>
    </PackageState>
    <PackageState cpe="cpe:/a:redhat:openshift:5">
        <ProductName>Red Hat OpenShift Container Platform 5</ProductName>
        <FixState>Not affected</FixState>
        <PackageName>openshift/ose-rhel-coreos-9</PackageName>
    </PackageState>
    <References xml:lang="en:us">
https://www.cve.org/CVERecord?id=CVE-2026-99261
https://nvd.nist.gov/vuln/detail/CVE-2026-99261
https://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e
https://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc
    </References>
</Vulnerability>