CVE-2026-43370

drm/amdgpu: Fix use-after-free race in VM acquire

State: Published
Severity: 7.8 High
Published: May 8, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix use-after-free race in VM acquire

Replace non-atomic vm->process_info assignment with cmpxchg() to prevent race when parent/child processes sharing a drm_file both try to acquire the same VM after fork().

(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before ae87aea330c24f462fc7058ed543ba8bc6798447Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 46d309996bd9251792d7dafdbaf615cf202b4447Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before e61e355cbe49e585097eee28c15b862bfb1c0668Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before c658c1c85ec235b7ecfbf8dbfee385b1332088f4Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 904025fa8bba1d028adade33346372b4ac1a9249Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 7885eb335d8f9e9942925d57e300a85e3f82ded4Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 94b7782d0c8024f5b88454241c8d4777076c3786Affected ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 2c1030f2e84885cc58bffef6af67d5b9d2e7098fAffected
LinuxLinux	4.17Affected before 4.17Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.19 through 6.18.Not affected 6.19.9 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before ae87aea330c24f462fc7058ed543ba8bc6798447Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 46d309996bd9251792d7dafdbaf615cf202b4447Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before e61e355cbe49e585097eee28c15b862bfb1c0668Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before c658c1c85ec235b7ecfbf8dbfee385b1332088f4Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 904025fa8bba1d028adade33346372b4ac1a9249Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 7885eb335d8f9e9942925d57e300a85e3f82ded4Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 94b7782d0c8024f5b88454241c8d4777076c3786Affected
ede0dd86f45adf2b7083bb161f6bc81da5fe2bad to before 2c1030f2e84885cc58bffef6af67d5b9d2e7098fAffected

LinuxLinux

4.17Affected
before 4.17Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.19 through 6.18.*Not affected
6.19.9 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.