What is the CVSS score of CVE-2026-72095?

CVE-2026-72095 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72095?

Organizations deploying AMD GPUs on Linux servers are vulnerable to local-origin memory corruption attacks (CVE-2026-72095, CVSS 7.8) if running unpatched kernels prior to version 6.18.40 or 7.1.5.. A patch is available.

How to fix or mitigate CVE-2026-72095?

Within 24 hours, catalog all Linux systems with AMD GPUs and compare their kernel versions against the fixed versions (6.18.40 or 7.1.5 depending on branch). Within 7 days, apply kernel updates to development and test environments, validate application stability with patched kernels, and prepare production deployment plans. Within 30 days, roll out patched kernels to production infrastructure with priority for systems hosting multi-tenant workloads, critical services, or environments with untrusted local user access.

Linux Kernel CVE-2026-72095

EUVD-2026-59053 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-cgwr-m873-g7w9

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and PR:L confirmed by amdgpu device node access requirement; uninitialized kernel memory dereference yields credible C:H/I:H/A:H impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 06:47 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dma-fence: Make dma_fence_dedup_array() robust against 0-count input

dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts both the kernel-doc ("Return: Number of unique fences remaining in the array") and the natural expectation that 0 input gives 0 output.

The caller __dma_fence_unwrap_merge() bails out via the if (count 0 || count 1) fast path and so is save.

But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array.

Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.

AnalysisAI

Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in dma_fence_dedup_array() that returns 1 instead of 0 for empty input, which the primary caller guards against but amdgpu_userq_wait_*() does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.

Technical ContextAI

The vulnerability is located in the dma-fence subsystem (dma_fence_dedup_array()), a kernel facility that manages GPU synchronization fence objects used to coordinate DMA operations across devices. The logic error is subtle: the function uses return ++j where j is initialized to 0; when the input num_fences is 0, the loop body never executes, and ++j yields 1 - contradicting both the kernel documentation and caller expectations. The primary caller __dma_fence_unwrap_merge() is safe because it checks count 0 || count 1 before calling dedup. However, the amdgpu driver's amdgpu_userq_wait_*() functions lack this guard and can reach the dedup call with a zero local count, causing a dereference of an uninitialized array slot - a memory safety violation consistent with CWE-457 (Use of Uninitialized Variable) or CWE-125 (Out-of-bounds Read). No formal CWE is assigned per the input data. The affected code was introduced at commit 575ec9b0c2f11f40535ea737ed5a64792780d1ef and the fix adds an early return 0 guard when num_fences == 0, also eliminating a redundant sort() call on an empty array.

RemediationAI

Update to Linux kernel 6.18.40, 7.1.5, or 7.2-rc2 (or any later release), which contain the one-line fix adding an early return 0 when num_fences == 0 in dma_fence_dedup_array(). Patch commits can be reviewed directly at https://git.kernel.org/stable/c/77a9298741f8f9e8b963c977f5582ab21c6d3427 (6.x stable), https://git.kernel.org/stable/c/7aa8f3dba53422465dbe1be8dbb7240304462bb2 (7.x stable), and https://git.kernel.org/stable/c/e2d9a2ea178a5da0b4a6693e8ebca5c7fc4d7051 (mainline). For systems that cannot be patched immediately, restricting unprivileged user access to the AMD GPU device node (e.g., tightening /dev/dri/ permissions or using a device cgroup policy) prevents untrusted local users from reaching the amdgpu_userq_wait_*() code path; note this will deny GPU access to those users and may break GPU compute workloads. Disabling the amdgpu module entirely (modprobe -r amdgpu) fully eliminates the attack surface but removes GPU functionality. Standard kernel hardening features (SMEP, SMAP, kernel address space layout randomization) reduce but do not eliminate exploitability of the resulting memory corruption.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72095 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72095

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code