CVE-2026-99261: 
Linux Kernel 취약점 분석 및 완화

CVE-2026-99261 is a vulnerability in the Linux kernel's drm/amdgpu driver related to incorrect reservation fence slot handling during userq per-VM buffer object (BO) eviction. The flaw causes both a move overflow and an incorrect eviction fence addition when evicting per-VM BOs. It affects Linux kernel versions in the 7.2.x series prior to 7.2.13, as well as Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.159.1-1. The vulnerability was published on November 3, 2026, and carries a CVSS v3.1 base score of 3.3 (Low) (GitHub Advisory, Microsoft).

The root cause is improper management of reservation fence slots within the AMDGPU DRM driver's userq (user queue) subsystem, specifically during the eviction of per-VM buffer objects. Two distinct bugs are addressed: an integer/buffer overflow in the move fence slot count, and an incorrect fence addition during the eviction process. Exploitation requires local access with low privileges (no user interaction needed), and the vulnerability is scoped to the affected system without privilege escalation beyond the GPU subsystem. No CWE classification has been formally assigned, but the behavior is consistent with improper resource management or integer overflow patterns (GitHub Advisory, Feedly).

Successful exploitation of this vulnerability can result in memory corruption and system instability on systems equipped with AMD GPUs, primarily affecting availability. The confidentiality and integrity impacts are rated as none, meaning data exposure or unauthorized modification are not direct consequences. The vulnerability is locally scoped and does not provide a pathway for remote code execution or lateral movement, limiting its overall risk to denial-of-service or GPU subsystem crashes on affected hosts (GitHub Advisory, Microsoft).

There are no known public proof-of-concept exploits or reports of in-the-wild exploitation for CVE-2026-99261. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.177% (7th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory).

The vulnerability is patched in Linux kernel version 7.2.13 and in the 7.3 release branch. Fixes are available via two upstream kernel commits: 76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc and 50b24a20be8c0d35f89f7d5c39533f69d84fe48e. Microsoft has also addressed the issue in its Azure Linux 3 kernel package. Users should update to Linux kernel 7.2.13 or later, or apply the relevant distribution-specific kernel update as soon as it becomes available (GitHub Advisory, Microsoft).