{"apiVersion":"1.0","identifier":"CVE-2026-72095","description":"In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma_fence_dedup_array() robust against 0-count input dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes, j stays at 0, and the final `return ++j` yields 1. This contradicts both the kernel-doc (-Return: Number of unique fences remaining in the array-) and the natural expectation that 0 input gives 0 output. The caller __dma_fence_unwrap_merge() bails out via the `if (count == 0 || count == 1)` fast path and so is save. But amdgpu_userq_wait_*() could reach the dedup call with a zero local count and dereference an uninitialized fence slot in the array. Make the contract match the documentation by returning 0 early. This also skips an unnecessary sort() call on an empty array.","publishedAt":"2026-08-15T06:21:23","lastModifiedAt":"2026-08-17T06:18:08","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72095","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00161,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72095","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72095","en":"https://www.redsauce.net/en/cves/CVE-2026-72095","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72095","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72095","de":"https://www.redsauce.net/de/cves/CVE-2026-72095","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72095","el":"https://www.redsauce.net/el/cves/CVE-2026-72095"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72095"}}