CVE-2026-80539

A flaw was found in the Linux kernel's drm/amdgpu graphics driver. When processing graphics commands, the driver fails to properly handle multiple "FENCE chunks" in a single submission. This oversight leads to a memory leak, where system resources are not released as expected. A local attacker could exploit this to exhaust available memory, potentially causing a Denial of Service (DoS) on the system.

A moderate-impact memory leak flaw was found in the Linux kernel's AMDGPU graphics driver, affecting the kernel and kernel-rt components of Red Hat Enterprise Linux 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components of Red Hat In-Vehicle OS 2. When processing a GPU command submission, amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated IDs. Because p->uf_bo is a single-slot field, a submission that carries two or more AMDGPU_CHUNK_ID_FENCE chunks runs amdgpu_cs_p1_user_fence() twice, and the second run overwrites p->uf_bo with a freshly referenced buffer object without dropping the reference taken by the first. Since amdgpu_cs_parser_fini() only unreferences the final p->uf_bo, every FENCE chunk but the last leaks a buffer-object reference that outlives handle close and process exit. A local attacker with access to the AMDGPU command submission interface (for example through a GPU render node) could exploit this by repeatedly issuing such submissions to leak kernel memory and exhaust system resources, causing a denial of service. There is no impact on confidentiality or integrity, and the issue is not network-reachable. Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. For the affected streams, the fix is deferred to a planned future update: exploitation requires local access to the GPU device and the impact is limited to availability, so the residual risk until the fix is delivered is that a local user could degrade system availability through memory exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.