{"id":"CVE-2026-72095","revision":"b76f710f957349afa263e9477366516b","records":[{"revision":"b76f710f957349afa263e9477366516b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72095","aliases":[],"title":"dma-fence: Make dma_fence_dedup_array() robust against 0-count input","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-fence: Make dma_fence_dedup_array() robust against 0-count input\n\ndma_fence_dedup_array() returns 1 when called with num_fences == 0:\nthe for-loop body never executes, j stays at 0, and the final\n`return ++j` yields 1. This contradicts both the kernel-doc (\"Return:\nNumber of unique fences remaining in the array\") and the natural\nexpectation that 0 input gives 0 output.\n\nThe caller __dma_fence_unwrap_merge() bails out via the\n`if (count == 0 || count == 1)` fast path and so is save.\n\nBut amdgpu_userq_wait_*() could reach the dedup call with a zero local\ncount and dereference an uninitialized fence slot in the array.\n\nMake the contract match the documentation by returning 0 early. This\nalso skips an unnecessary sort() call on an empty array.","state":0,"publishedAt":"2026-08-15T05:52:41.47+00:00","modifiedAt":"2026-10-19T21:19:27.366+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/dma-buf/dma-fence-unwrap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"575ec9b0c2f11f40535ea737ed5a64792780d1ef\",\n                            \"lessThan\": \"7aa8f3dba53422465dbe1be8dbb7240304462bb2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"575ec9b0c2f11f40535ea737ed5a64792780d1ef\",\n                            \"lessThan\": \"e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"575ec9b0c2f11f40535ea737ed5a64792780d1ef\",\n                            \"lessThan\": \"77a9298741f8f9e8b963c977f5582ab21c6d3427\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/dma-buf/dma-fence-unwrap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7aa8f3dba53422465dbe1be8dbb7240304462bb2","https://git.kernel.org/stable/c/e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051","https://git.kernel.org/stable/c/77a9298741f8f9e8b963c977f5582ab21c6d3427"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72095","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72095","identifiers":["CVE-2026-72095"]},"retained":false,"historicalAffected":[]}],"coverage":[]}