Linux Kernel amdgpu amdgpu_userq.c amdgpu_evf_mgr_flush_suspend resource consumption

Summaryinfo

A vulnerability was found in Linux Kernel. It has been declared as critical. Affected by this vulnerability is the function amdgpu_evf_mgr_flush_suspend of the file drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c of the component amdgpu. Such manipulation leads to resource consumption. This vulnerability is documented as CVE-2026-68237. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel (version now known). Affected by this issue is the function amdgpu_evf_mgr_flush_suspend of the file drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c of the component amdgpu. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset pre_reset only force-completes fences of MAPPED queues. A queue in any other state (e.g. mid-eviction) keeps its last_fence pending; after a GPU reset that fence never signals, so the eviction/suspend worker and process teardown (amdgpu_evf_mgr_flush_suspend) wait on it forever and wedge the machine: INFO: task kworker/6:28 blocked for more than 120 seconds. Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu] Call Trace: dma_fence_wait_timeout+0x7e/0x130 amdgpu_userq_evict+0x67/0x140 [amdgpu] amdgpu_eviction_fence_suspend_worker+0xd8/0x160 [amdgpu] process_scheduled_works+0xa6/0x420 Force-complete every queue's fence regardless of state. The unmap and mark-hung step stays gated on MAPPED, since unmapping a queue that is not mapped is invalid. (cherry picked from commit 9102b39fa924dcc3dc75a3137bfa9633c40b88c0)

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-68237 since 07/30/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Applying the patch 9102b39fa924dcc3dc75a3137bfa9633c40b88c0 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion