Linux Kernel EUVD-2026-55484

The amdgpu driver implements DRM user-space queues where user processes submit a doorbell Buffer Object (BO) handle and an intra-BO offset to obtain a GPU doorbell - a memory-mapped register used to signal the GPU that work is ready. Doorbell-to-queue mappings are stored in a Linux XArray (xa). The bug is that xa_store_irq() unconditionally overwrites an existing XArray entry, so a second queue created with the same BO handle and offset silently replaces the first queue's mapping. This causes two distinct failure modes: fence completion interrupts (IRQs) for the victim queue are delivered to the attacker's queue, and when the attacker's queue is torn down its cleanup code deletes the XArray entry that still belongs to the victim queue. The fix substitutes xa_insert_irq(), which returns -EBUSY if the key is already occupied. No CWE was formally assigned, but the class most closely matches CWE-667 (Improper Locking / Concurrent Resource Mismanagement) or CWE-99 (Improper Control of Resource Identifiers). Affected CPE: cpe:2.3:a:linux:linux.