VulnerabilityPublished 28 Oct 2026

CVE-2026-99119: Linux kernel · drm/amdgpu/userq: actually validate userq BOs

Source GCVE Database

Authoritative record:CVE-2026-99119

Not known to be exploited : upgrade to d1d6b859e89dd274cd0fae77503cdf91be8310c0 or 32d0771ef4ca69c30a1db3aefa34dd177cd2a047 when convenient.

Data as of 28 Oct 2026, 14:14 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Patch: Available – fixed in d1d6b859e89dd274cd0fae77503cdf91be8310c0, 32d0771ef4ca69c30a1db3aefa34dd177cd2a047

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-wrf7-g73g-gr9r

What to do

Upgrade Linux kernel to d1d6b859e89dd274cd0fae77503cdf91be8310c0 or 32d0771ef4ca69c30a1db3aefa34dd177cd2a047.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 4cdbba5a16aaf16513b69cc332b1d6f971a44b52, < d1d6b859e89dd274cd0fae77503cdf91be8310c0	Fixed in d1d6b859e89dd274cd0fae77503cdf91be8310c0
LinuxLinux	Affected ≥ 4cdbba5a16aaf16513b69cc332b1d6f971a44b52, < 32d0771ef4ca69c30a1db3aefa34dd177cd2a047	Fixed in 32d0771ef4ca69c30a1db3aefa34dd177cd2a047
LinuxLinux	Affected =7.2	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel by correcting the validation logic for userq BOs and adding the missing reference before locking. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.

Description

A vulnerability in the Linux kernel's AMDGPU driver related to user queue (userq) buffer objects (BOs) was resolved. The issue involved improper validation of BOs that were created and evicted before a userq was established, causing them to be excluded from eviction fence rearm processing. Additionally, a missing reference to the BO before locking and referencing it was corrected.

Impact

The vulnerability could lead to improper handling of buffer objects in the AMDGPU driver, potentially causing resource management inconsistencies or stability issues in the kernel. However, no exploit in the wild or specific impact scenarios are documented in the provided data.

Summary

CVE-2026-99119 addresses a flaw in the Linux kernel's AMDGPU driver where userq BOs were not properly validated. Specifically, BOs created and evicted prior to the creation of a userq were not included in the eviction fence rearm process due to missing iteration over the individual evicted list. The fix involved correctly looping over this list and adding a missing reference to the BO before drm_exec locks and references it. This ensures proper handling and validation of BOs in the eviction process, preventing potential kernel resource management issues.

References

Community reviews

Loading reviews…