{"id":"CVE-2026-99261","kind":"vulnerability","aliases":["CVE-2026-99261"],"related":[],"title":"Linux kernel: AMD GPU driver fence slot error during buffer eviction","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\n\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs.","summary":"The Linux kernel's AMD GPU (amdgpu) driver miscounted reservation fence slots when evicting per-VM buffer objects for user queues, causing a move overflow and a failed eviction fence add. The sources do not state what an attacker gets from this flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amdgpu","drm","linux-kernel","runtime"],"not_affected_if":["amdgpu-not-loaded","no-amd-gpu"],"how_to_check":"- Run `uname -r` and compare against the kernel versions named in the vendor advisory\n- Check whether the `amdgpu` driver is loaded with `lsmod | grep amdgpu`","fix":null,"status":"open","published_at":"2026-11-03T12:17:33+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","triaged_at":"2026-11-03T12:22:46+00:00","updated_at":"2026-11-03T12:22:46+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-11-03T12:22:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: AMD GPU driver fence slot error during buffer eviction","impact":"medium","summary":"The Linux kernel's AMD GPU (amdgpu) driver miscounted reservation fence slots when evicting per-VM buffer objects for user queues, causing a move overflow and a failed eviction fence add. The sources do not state what an attacker gets from this flaw.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","amdgpu","drm"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown: sources do not describe the impact","analyst_note":"Find the kernel stable commit or NVD analysis to confirm affected version ranges, fixed versions and the actual security impact (denial of service or memory corruption).","how_to_check":"- Run `uname -r` and compare against the kernel versions named in the vendor advisory\n- Check whether the `amdgpu` driver is loaded with `lsmod | grep amdgpu`\n- unknown: the sources do not list affected kernel version ranges","plain_action":"","needs_analyst":true,"not_affected_if":["no-amd-gpu","amdgpu-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the AMD GPU (amdgpu) driver and user queues enabled. The sources do not say which kernel versions are affected or what the impact is on systems without AMD GPUs.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4109,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99261':14A,17A 'add':55B,100C 'amd':3A,28B 'amdgpu':18B,30B 'attack':63B 'bos':88C,107C 'buffer':10A,41B 'caus':46B 'correct':79C 'cve':12A,15A 'driver':5A,31B 'drm':19B 'drm/amdgpu':78C 'error':8A 'evict':11A,37B,53B,89C,98C,102C 'fail':52B 'fenc':6A,34B,54B,81C,99C 'fix':91C 'flaw':67B 'follow':73C 'get':64B 'gpu':4A,29B 'kernel':2A,22B,26B,71C 'linux':1A,21B,25B,70C 'linux-kernel':20B 'miscount':32B 'move':48B,94C 'object':42B 'overflow':49B,95C 'per':39B,86C,105C 'per-vm':38B,85C,104C 'queue':45B 'reserv':33B,80C 'resolv':77C 'runtim':23B 'slot':7A,35B,82C 'sourc':57B 'state':60B 'user':44B 'userq':84C 'vm':40B,87C,106C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the AMD GPU (amdgpu) driver and user queues enabled. The sources do not say which kernel versions are affected or what the impact is on systems without AMD GPUs.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amdgpu","drm","linuxkernel","runtime","unknown"],"first_public_at":"2026-11-03T12:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99261","severity":null,"published_at":"2026-11-03T12:17:33+00:00","modified_at":"2026-11-03T12:17:33+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","fetched_at":"2026-11-03T12:20:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}