CVE-2026-43399: Linux Kernel Privilege Escalation Flaw

CVE-2026-43399 Overview

CVE-2026-43399 is a reference leak vulnerability in the Linux kernel's AMD GPU (amdgpu) driver. The flaw resides in the amdgpu_userq_wait_ioctl function within the user queue (userq) subsystem. When the ioctl aborts because the supplied output array is too small, the kernel fails to drop references to the synchronization object (syncobj) and the timeline fence. Repeated invocation of the affected ioctl can exhaust kernel resources tracked by these reference counts. The issue has been resolved upstream and backported to stable kernel branches.

Critical Impact
Local users with access to the AMD GPU device can trigger a kernel reference leak through repeated ioctl calls, potentially leading to resource exhaustion and denial of service on affected systems.

Affected Products

Linux kernel branches containing the drm/amdgpu/userq subsystem prior to the fix commits
Systems using AMD GPU hardware with the amdgpu kernel driver
Stable kernel trees that received the original change before the cherry-picked fix from commit 68951e9c3e6bb22396bc42ef2359751c8315dd27

Discovery Timeline

2026-05-08 - CVE-2026-43399 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43399

Vulnerability Analysis

The vulnerability is a memory/resource leak in the AMD GPU user queue wait ioctl handler. The amdgpu_userq_wait_ioctl function allows userspace to wait on a collection of synchronization objects associated with user queues. During processing, the kernel acquires references on syncobj instances and their associated timeline fences before returning data to userspace.

The handler performs a validation check to ensure the userspace-supplied output array is large enough to hold the results. When this check fails, the function takes an early-exit error path. The flawed code path returns immediately without releasing the references it already acquired on the syncobjects and timeline fences. Each failed invocation increments reference counts that are never decremented.

Root Cause

The root cause is an incomplete cleanup path in amdgpu_userq_wait_ioctl. The ioctl handler acquires reference counts on kernel objects during its main processing logic but does not call the corresponding _put reference-drop routines on the error branch that handles an undersized output array. This is a classic resource management bug where the acquisition path and the abort path are not balanced.

Attack Vector

A local, unprivileged user with permission to open the AMD DRM device node (typically /dev/dri/cardN or /dev/dri/renderDN) can invoke the amdgpu_userq_wait_ioctl ioctl with a deliberately undersized output array. Each call leaks references inside the kernel. Repeated invocation in a loop can pin syncobjects and fences in memory indefinitely, exhausting kernel resources. The vulnerability does not require network access and cannot be exploited remotely. No verified exploit code is publicly available for CVE-2026-43399. Refer to the upstream commits for the precise patched logic: Kernel Git Commit 49abfa812617, Kernel Git Commit 5409247d41f3, and Kernel Git Commit 762f47e2b824.

Detection Methods for CVE-2026-43399

Indicators of Compromise

Sustained growth of kernel slab allocations associated with drm_syncobj and dma_fence objects on systems using AMD GPUs
Processes repeatedly invoking ioctls on /dev/dri/* device nodes with truncated or undersized output buffers
Gradual degradation of GPU workload performance accompanied by increased kernel memory utilization

Detection Strategies

Monitor /proc/slabinfo for abnormal growth in drm_syncobj and related fence-tracking caches over time
Audit ioctl usage against the amdgpu driver using bpftrace or perf to capture callers issuing DRM_IOCTL_AMDGPU_USERQ_WAIT with returning error codes
Verify the running kernel version against the patched stable releases referenced in the kernel.org commits

Monitoring Recommendations

Collect kernel memory telemetry and alert on unbounded growth in DRM subsystem allocations
Track ioctl error rates per process to identify workloads issuing repeated failing calls to amdgpu_userq_wait_ioctl
Centralize syslog and kernel logs for hosts with AMD GPUs so anomalies in DRM behavior can be correlated across the fleet

How to Mitigate CVE-2026-43399

Immediate Actions Required

Apply the stable kernel update that contains the fix commits referenced by kernel.org and reboot affected systems
Inventory all hosts running AMD GPU hardware and identify kernels predating the patched stable releases
Restrict access to DRM device nodes so only trusted local users and services can issue ioctls to the amdgpu driver

Patch Information

The fix is contained in the upstream commit 68951e9c3e6bb22396bc42ef2359751c8315dd27 and was backported through the following stable tree commits: Kernel Git Commit 49abfa812617, Kernel Git Commit 5409247d41f3, and Kernel Git Commit 762f47e2b824. The patch adds the missing reference-drop calls on the error path when the output array is too small. Update to a distribution kernel that includes these commits as soon as it is available.

Workarounds

Tighten permissions on /dev/dri/renderD* and /dev/dri/card* device nodes to limit which local users can submit ioctls
Avoid running untrusted workloads with access to AMD GPU devices until the patched kernel is deployed
Where feasible, disable the amdgpu user queue feature in environments that do not require it

bash

# Verify the running kernel includes a fix commit
uname -r
zcat /proc/config.gz | grep CONFIG_DRM_AMDGPU

# Restrict access to DRM render nodes to the 'render' group
chgrp render /dev/dri/renderD*
chmod 660 /dev/dri/renderD*