CVE-2026-46220None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions that verify fence writeback addr…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions that verify fence writeback addresses are dword-aligned. These assertions can be reached from unprivileged userspace via crafted DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a scheduler worker thread.
Replace both BUG_ON() calls with WARN_ON() to log the condition without crashing the kernel. A misaligned fence address at this point indicates a driver bug, but crashing the kernel is never the correct response when the assertion is reachable from userspace.
The CS IOCTL path is the correct place to filter invalid submissions; the ring emission callback is too late to do anything about it.
(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)
Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < ecaa80318e900ca0c3f687742ede33b41cfd2f8eLinux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 25e7d56a39657d56d1ea6d78992f7ed15dedb412Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < d4c56932d29773e278be6a65a5384a36c95b89a4Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 4f7ca00fa91daf0795ec6b3b130c5ebba1f155feLinux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < d331fb241a4602253976ddd65144a8ba2b05665dLinux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 0b91ea46bb68abf98a082bf239092253bbd6aaa2Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < a4fd82fb0757c180bf622907397c528b89a827b2Linux >= 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 < 78d2e624fa073c14970aa097adcf3ea31c157a66Linux 4.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses