CVE-2026-43370 drm/amdgpu: Fix use-after-free race in VM acquire
A race condition in the AMD GPU driver allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43370?
CVE-2026-43370 is a high-severity use after free vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix use-after-free race in VM acquire
Replace non-atomic vm->process_info assignment with cmpxchg() to prevent race when parent/child processes sharing a drm_file both try to acquire the same VM after fork().
(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
Which versions are affected by CVE-2026-43370?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43370?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-43370 being exploited?
There is no known exploitation of CVE-2026-43370 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43370, DEBIAN-CVE-2026-43370, GHSA-f593-x5jj-v2pg, ROOT-OS-DEBIAN-11-CVE-2026-43370, ROOT-OS-UBUNTU-2204-CVE-2026-43370, ROOT-OS-UBUNTU-2404-CVE-2026-43370 and 1 more.