CVE-2026-46311

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: fix access to stale wptr mapping

Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly.

This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address.

(cherry picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
LinuxLinux>= 5fb2f7fc21a3668e5794cc0d153641b9719713e1, < 2da62dbb4169e758c0b1a9378b39a373bf4fb111; >= 5fb2f7fc21a3668e5794cc0d153641b9719713e1, < 336a9186f3a4b65bbd865d93936605ac8a1a3991; >= 5fb2f7fc21a3668e5794cc0d153641b9719713e1, < 6da7b1242da4455b11c24ce667d1cab1a348c8ea
LinuxLinux6.16

References

Timeline

Published
Jun 8, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-463125.5In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap vb2_dma_contig setsCVE-2026-463135.5In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->CVE-2026-463145.5In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3dCVE-2026-463155.5In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORICVE-2026-463169.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for theCVE-2026-463178.8In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nesteCVE-2026-463185.5In the Linux kernel, the following vulnerability has been resolved: Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverCVE-2026-463197.8In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When lookingCVE-2026-46327.3A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/iCVE-2026-463207.4In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp()CVE-2026-463217.1In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one()CVE-2026-463227.1In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb()
CVE-2026-46311: High severity, CVSS 7.8 | Vulnix