CVE-2026-99119 drm/amdgpu/userq: actually validate userq BOs
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99119?
CVE-2026-99119 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: actually validate userq BOs
This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already handled in amdgpu_vm_validate.
Without this, BOs that were created and evicted before a userq was made would never end up in an eviction fence rearm.
Also add the missing ref to the BO before drm_exec locks and refs it.
(cherry picked from commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd)
Which versions are affected by CVE-2026-99119?
How do I fix CVE-2026-99119?
Upgrade to a fixed version.
Is CVE-2026-99119 being exploited?
There is no known exploitation of CVE-2026-99119 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-99119, GHSA-wrf7-g73g-gr9r, UBUNTU-CVE-2026-99119.