CVE-2026-46311: drm/amdgpu/userq: fix access to stale wptr mapping

Synopsis

A stale-pointer vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu) allows a local attacker with a low-privilege account to exploit a race condition between queue creation and wptr_obj unmapping. By substituting a different buffer object at the same address during queue creation, an attacker can access stale mapping data in the userq subsystem. Successful exploitation gives the attacker full read, write, and crash capabilities over the affected system. A patched-image rebuild at the fix commits and version 7.0.9 is available on HarborGuard for environments running an affected kernel.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable queue creation path in the amdgpu driver.

• Victim interactionNot required

  The attacker can carry out the exploit entirely on their own without requiring any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race-window tuning or specific memory layout is required beyond the inherent race in queue creation.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including stored credentials, session tokens, and other sensitive in-memory data.
• A successful attacker writes to kernel memory structures, enabling privilege escalation or persistent modification of security-relevant kernel state.
• A successful attacker can crash the affected host by corrupting kernel data, causing a denial of service for all workloads on that node.
• Container workloads sharing the host kernel are exposed to the same impact, since kernel memory is not isolated between containers on the same node.