CVE-2026-23034: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23034 is a memory leak vulnerability in the Linux kernel's AMD GPU (drm/amdgpu) user mode queue implementation, specifically in the queue teardown path. When a user mode queue is destroyed, the driver fails to call dma_fence_put() on the userq->last_fence pointer, leaving a fence object allocated in the amdgpu_userq_fence slab cache after driver unload. The vulnerability affects Linux kernel versions from commit edc762a51c71 up to (but not including) the patched commits, with fixes available in Linux 6.18.7 and 6.19-rc6. It carries an estimated CVSS severity of Medium and an EPSS score of 0.018% (Red Hat Bugzilla, Feedly).

The root cause is a missing reference count decrement (CWE-401: Missing Release of Memory after Effective Lifetime) in the amdgpu_userq_fence_driver_free() function. The userq->last_fence field holds an extra dma_fence reference that is never released when the queue is torn down — the fence driver and its xarray are freed, but dma_fence_put() is never called on the last fence pointer. This causes the fence object to persist in the amdgpu_userq_fence slab cache, triggering a kernel BUG message (BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()) during driver unload. The fix, cherry-picked from upstream commit 8e051e38a8d4, adds a dma_fence_put() call and clears the pointer in amdgpu_userq_fence_driver_free() (Red Hat Bugzilla).

The primary impact is a kernel memory leak during AMD GPU driver unload, manifesting as unreleased objects in the amdgpu_userq_fence slab cache. Repeated cycles of user mode queue creation and destruction can accumulate leaked fence references, potentially degrading system stability over time. This vulnerability does not directly enable code execution, privilege escalation, or data exfiltration, but it can contribute to resource exhaustion on systems with AMD GPUs that make heavy use of user mode queues (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability requires local access to trigger user mode queue operations on an AMD GPU. The EPSS score is approximately 0.018%, reflecting very low likelihood of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel log messages containing BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown() or kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects during AMD GPU driver unload.
• Logs: Kernel call trace involving kmem_cache_destroy, amdgpu_userq_fence_slab_fini, amdgpu_exit, and __do_sys_delete_module in dmesg or /var/log/kern.log.

Apply the upstream kernel fix available in Linux 6.18.7 and 6.19-rc6, which adds a dma_fence_put() call in amdgpu_userq_fence_driver_free() (upstream commit 8e051e38a8d4, stable patches at commits e1a30e1ab33f and b2426a211dba). If immediate patching is not feasible, limit access to AMD GPU user mode queue operations and monitor kernel logs for BUG amdgpu_userq_fence messages as an indicator of the issue being triggered. Applying distribution-provided kernel updates (e.g., from Red Hat, SUSE) that include this fix is the recommended remediation path (Red Hat Bugzilla, Feedly).