CVE-2026-43237: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43237 Overview

CVE-2026-43237 is a use-after-free vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The flaw resides in the amdgpu_gem_va_ioctl function, which handles GPU virtual address mapping operations. The function selected a dma_fence reference too early and failed to manage its reference count correctly. This led to refcount underflows and potential use-after-free conditions on dma_fence objects when GPU timelines were updated.

Upstream maintainers refactored the code to choose the fence only after the VA mapping work completes, take a safe reference, and drop the local reference after exporting it to the VM timeline syncobj.

Critical Impact
A local user issuing GPU ioctls can trigger a kernel panic and a fatal exception in interrupt context, resulting in denial of service and potential memory corruption on systems using the AMD GPU driver.

Affected Products

Linux kernel versions containing the affected amdgpu_gem_va_ioctl implementation
Systems using the AMD GPU (amdgpu) Direct Rendering Manager driver
Distributions shipping kernels prior to the commits referenced in the upstream advisory

Discovery Timeline

2026-05-06 - CVE-2026-43237 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43237

Vulnerability Analysis

The vulnerability stems from incorrect lifetime management of a dma_fence object inside amdgpu_gem_va_ioctl. The previous implementation selected the last update fence too early in the ioctl flow. As a result, the driver could hold a stale or freed fence pointer by the time the VM timeline was updated.

The crash signature shows a refcount_t: underflow; use-after-free warning originating from lib/refcount.c:28 and reaching amdgpu_gem_va_ioctl+0x6ea/0x740. Subsequent fence signaling work executed in interrupt context dereferenced the freed object inside dma_fence_signal_timestamp_locked. This produced a fatal page fault for address ffffffffc0dfde90 and a kernel panic with the message Fatal exception in interrupt.

Root Cause

The root cause is improper reference counting on a dma_fence during GEM virtual address ioctl processing. The fence was captured before the VA mapping work completed, and the local reference was not balanced against the syncobj export path. Concurrent GPU completion handlers, including amdgpu_fence_process invoked from sdma_v4_0_process_trap_irq, could free the fence while the ioctl path still held a pointer to it.

Attack Vector

A local, unprivileged process with access to the /dev/dri/card* device node can invoke the DRM_IOCTL_AMDGPU_GEM_VA ioctl with crafted parameters. Triggering the racy fence handling path leads to refcount underflow on struct dma_fence. Because the corruption surfaces during interrupt-driven fence signaling, the result is a kernel panic and host denial of service. Memory corruption on freed kernel slab objects also creates conditions that could be leveraged for further exploitation on a contested allocator.

The vulnerability is described in prose only; no public proof-of-concept code is referenced. See the upstream patches: Kernel Git Commit 0399b84, Kernel Git Commit bd8150a1, and Kernel Git Commit e9e477d3.

Detection Methods for CVE-2026-43237

Indicators of Compromise

Kernel log entries containing refcount_t: underflow; use-after-free originating from lib/refcount.c:28 and refcount_warn_saturate.
Stack traces referencing amdgpu_gem_va_ioctl+0x6ea/0x740 followed by drm_ioctl_kernel and __x64_sys_ioctl.
Page fault crashes inside dma_fence_signal_timestamp_locked reached from amdgpu_fence_process and sdma_v4_0_process_trap_irq.
Kernel panic messages stating Fatal exception in interrupt on hosts using the amdgpu driver.

Detection Strategies

Monitor dmesg and /var/log/kern.log for refcount warnings and oops traces involving the amdgpu module.
Compare the running kernel version and module build IDs against fixed builds referenced in the upstream commits.
Audit user-space processes invoking DRM ioctls on /dev/dri/card* to identify abnormal GPU ioctl patterns from unprivileged accounts.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized analytics platform for correlation across fleet hosts.
Alert on repeated GPU driver oopses or unscheduled reboots on workstations and AI/ML training nodes using AMD GPUs.
Track package and kernel patch state with configuration management tooling to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-43237

Immediate Actions Required

Update affected systems to a Linux kernel build that includes commits 0399b84, bd8150a1, and e9e477d3 from the stable tree.
Reboot hosts after kernel installation to load the patched amdgpu module.
Restrict access to DRM device nodes (/dev/dri/*) to trusted local users where GPU access is not required by all accounts.

Patch Information

The fix moves last-update fence handling into amdgpu_gem_va_update_vm and adds checks for the timeline point to enable conditional replacement or addition of fences. The fence is now chosen only after the VA mapping work completes, its reference is taken safely, and the driver always drops its local reference after exporting it to the VM timeline syncobj. Patches are available at Kernel Git Commit 0399b84, Kernel Git Commit bd8150a1, and Kernel Git Commit e9e477d3.

Workarounds

Limit local shell access on systems exposing AMD GPU devices to reduce the population that can issue DRM ioctls.
Where feasible, unload the amdgpu module on systems that do not require accelerated graphics or compute until the patched kernel is deployed.
Apply Linux kernel lockdown or seccomp policies that constrain ioctl exposure for untrusted workloads and containers.

bash

# Verify running kernel and amdgpu module version after patching
uname -r
modinfo amdgpu | grep -E '^(version|srcversion|filename):'
# Restrict DRM device access to the video group
ls -l /dev/dri/
sudo chgrp video /dev/dri/card* /dev/dri/renderD*
sudo chmod 0660 /dev/dri/card* /dev/dri/renderD*