{
  "cveId": "CVE-2026-23034",
  "url": "https://patchblox.com/security/cve/CVE-2026-23034",
  "summary": "CVE-2026-23034 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23034 (version 6.18.8-1), released January 31, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu/userq: Fix fence reference leak on qu...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu/userq: Fix fence reference leak on queue teardown v2  The user mode queue keeps a pointer to the most recent fence in userq-\u003Elast_fence. This pointer holds an extra dma_fence reference.  When the queue is destroyed, we free the fence driver and its xarray, but we forgot to drop the last_fence reference.  Because of the missing dma_fence_put(), the last fence object can stay alive when the driver unloads. This leaves an allocated object in the amdgpu_userq_fence slab cache and triggers  This is visible during driver unload as:    BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()   kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects   Call Trace:     kmem_cache_destroy     amdgpu_userq_fence_slab_fini     amdgpu_exit     __do_sys_delete_module  Fix this by putting userq-\u003Elast_fence and clearing the pointer during amdgpu_userq_fence_driver_free().  This makes sure the fence reference is released and the slab cache is empty when the module exits.  v2: Update to only release userq-\u003Elast_fence with dma_fence_put()     (Christian)  (cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)",
  "published": "2026-01-31T12:16:06Z",
  "severity": "",
  "epss": 0.00199,
  "epssPercentile": 0.0971,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.8-1",
      "fix": "DEBIAN-CVE-2026-23034",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23034",
      "released": "2026-01-31T12:16:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}