CVE-2026-72094

A flaw was found in the Linux kernel's dma-fence subsystem. This vulnerability arises from a timing issue on weakly ordered platforms, where memory operations related to fence signaling and pointer nullification can occur out of order. This can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because it requires local system access and is limited to causing a denial of service via a kernel crash, without permitting privilege escalation or data compromise. The flaw is confined to weakly ordered hardware architectures handling asynchronous buffer fence synchronization. Red Hat Enterprise Linux releases are not affected as the upstream commit introducing this regression is not present in supported kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.