PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46311 Linux CVE debrief

A vulnerability was found in the Linux kernel's drm/amdgpu/userq component. The issue arises from improper access to stale wptr mapping data. This can occur when the wptr_obj is unmapped during queue creation, and another buffer object (bo) is passed to the same address. The fix involves using drm_exec to take both locks, i.e., vm root bo and wptr_obj bo, to properly access the mapping data.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel, particularly those using the amd gpu driver, should be aware of this vulnerability. An attacker with local access could potentially exploit this issue to gain elevated privileges.

Technical summary

The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the kernel patch that fixes the issue.
  • Use official distribution mechanisms to update the kernel.

Evidence notes

The CVE record was obtained from the official CVE website. Additional information was obtained from the NVD database.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46311 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46311

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46311 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46311

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/336a9186f3a4b65bbd865d93936605ac8a1a3991

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6da7b1242da4455b11c24ce667d1cab1a348c8ea

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.