CVE-2026-72095dma-fence: Make dma_fence_dedup_array() robust against 0-count input
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma_fence_dedup_array() robust against 0-count input dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output. The caller __dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path and so is save. But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 575ec9b0c2f11f40535ea737ed5a64792780d1ef builds before 7aa8f3dba53422465dbe1be8dbb7240304462bb2; from 575ec9b0c2f11f40535ea737ed5a64792780d1ef before e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051; 575ec9b0c2f11f40535ea737ed5a64792780d1ef builds before 77a9298741f8f9e8b963c977f5582ab21c6d3427 | CNA record |
References
- https://git.kernel.org/stable/c/7aa8f3dba53422465dbe1be8dbb7240304462bb2
- https://git.kernel.org/stable/c/e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051
- https://git.kernel.org/stable/c/77a9298741f8f9e8b963c977f5582ab21c6d3427
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.