CVE-2026-43370CWE-362CWE-416

CVE-2026-43370

High · published May 8, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix use-after-free race in VM acquire

Replace non-atomic vm->process_info assignment with cmpxchg()

to prevent race when parent/child processes sharing a drm_file

both try to acquire the same VM after fork().

(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00097 · 0.7th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-05-08T19:16Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 4.17, < 5.10.2535.10.253
linux/linux_kernel≥ 5.11, < 5.15.2035.15.203
linux/linux_kernel≥ 5.16, < 6.1.1676.1.167
linux/linux_kernel≥ 6.2, < 6.6.1306.6.130
linux/linux_kernel≥ 6.7, < 6.12.786.12.78
linux/linux_kernel≥ 6.13, < 6.18.196.18.19
linux/linux_kernel≥ 6.19, < 6.19.96.19.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (8)
EPSS history
Timeline
  • 08 MAY 14:21Z
    drm/amdgpu: Fix use-after-free race in VM acquire
    cvelistv5