High severity7.8NVD Advisory· Published Apr 24, 2026· Updated Jun 17, 2026
CVE-2026-31566
CVE-2026-31566
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.
Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().
If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.
Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.
Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)
(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
100cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.0.1,<6.1.168
- cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
- (no CPE)
- osv-coords90 versionspkg:linux/kernelpkg:rpm/almalinux/bpftoolpkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-64kpkg:rpm/almalinux/kernel-64k-corepkg:rpm/almalinux/kernel-64k-debugpkg:rpm/almalinux/kernel-64k-debug-corepkg:rpm/almalinux/kernel-64k-debug-develpkg:rpm/almalinux/kernel-64k-debug-devel-matchedpkg:rpm/almalinux/kernel-64k-debug-modulespkg:rpm/almalinux/kernel-64k-debug-modules-corepkg:rpm/almalinux/kernel-64k-debug-modules-extrapkg:rpm/almalinux/kernel-64k-develpkg:rpm/almalinux/kernel-64k-devel-matchedpkg:rpm/almalinux/kernel-64k-modulespkg:rpm/almalinux/kernel-64k-modules-corepkg:rpm/almalinux/kernel-64k-modules-extrapkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-develpkg:rpm/almalinux/kernel-debug-devel-matchedpkg:rpm/almalinux/kernel-debug-modulespkg:rpm/almalinux/kernel-debug-modules-corepkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-debug-uki-virtpkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-devel-matchedpkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-modules-corepkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-modules-extra-matchedpkg:rpm/almalinux/kernel-rtpkg:rpm/almalinux/kernel-rt-64kpkg:rpm/almalinux/kernel-rt-64k-corepkg:rpm/almalinux/kernel-rt-64k-debugpkg:rpm/almalinux/kernel-rt-64k-debug-corepkg:rpm/almalinux/kernel-rt-64k-debug-develpkg:rpm/almalinux/kernel-rt-64k-debug-modulespkg:rpm/almalinux/kernel-rt-64k-debug-modules-corepkg:rpm/almalinux/kernel-rt-64k-debug-modules-extrapkg:rpm/almalinux/kernel-rt-64k-develpkg:rpm/almalinux/kernel-rt-64k-modulespkg:rpm/almalinux/kernel-rt-64k-modules-corepkg:rpm/almalinux/kernel-rt-64k-modules-extrapkg:rpm/almalinux/kernel-rt-corepkg:rpm/almalinux/kernel-rt-debugpkg:rpm/almalinux/kernel-rt-debug-corepkg:rpm/almalinux/kernel-rt-debug-develpkg:rpm/almalinux/kernel-rt-debug-modulespkg:rpm/almalinux/kernel-rt-debug-modules-corepkg:rpm/almalinux/kernel-rt-debug-modules-extrapkg:rpm/almalinux/kernel-rt-develpkg:rpm/almalinux/kernel-rt-modulespkg:rpm/almalinux/kernel-rt-modules-corepkg:rpm/almalinux/kernel-rt-modules-extrapkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-tools-libs-develpkg:rpm/almalinux/kernel-uki-virtpkg:rpm/almalinux/kernel-uki-virt-addonspkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/kernel-zfcpdump-develpkg:rpm/almalinux/kernel-zfcpdump-devel-matchedpkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/kernel-zfcpdump-modules-corepkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/libperfpkg:rpm/almalinux/perfpkg:rpm/almalinux/python3-perfpkg:rpm/almalinux/rtlapkg:rpm/almalinux/rvpkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0
>= 6.0.0, < 6.1.168+ 89 more
- (no CPE)range: >= 6.0.0, < 6.1.168
- (no CPE)range: < 4.18.0-553.168.1.el8_10
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 6.12.0-211.55.1.el10_2
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 5.14.0-687.47.1.el9_8
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1.160000.2.19
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
Patches
Vulnerability mechanics
References
6- git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69nvdPatch
- git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4nvdPatch
- git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ecnvdPatch
- git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85benvdPatch
- git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848bnvdPatch
- git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070nvdPatch
News mentions
0No linked articles in our index yet.