CVE-2026-72095

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the dma fence dedup array() function where it returns 1 instead of 0 when called with the num fences variable equal to 0. This behavior occurs because the for-loop body does not execute, leaving the variable j at 0, and the final return ++j operation results in 1. While the dma fence unwrap merge() function is not affected due to a fast path check, the amdgpu userq wait *() functions could call the dedup function with a zero local count, potentially leading to the dereference of an uninitialized fence slot in the array.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.