{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: disallow multiple FENCE chunks in one submit  amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated ids. p-\u003euf_bo is a single-slot field, so a submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs amdgpu_cs_p1_user_fence() twice, and the second run overwrites p-\u003euf_bo with a freshly referenced BO without dropping the reference taken by the first.  amdgpu_cs_parser_fini() only unrefs the final p-\u003euf_bo, so every FENCE chunk but the last leaks a BO reference. The leaked BO outlives handle close and process exit.  Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc (\"drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit\") did for p-\u003ebo_list.  (cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)",
  "id": "DEBIAN-CVE-2026-80539",
  "modified": "2026-09-19T21:47:27.098407753Z",
  "published": "2026-08-26T15:17:08.133Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80539"
    }
  ],
  "upstream": [
    "CVE-2026-80539"
  ]
}