CVE-2026-68237: drm/amdgpu/userq: fix indefinite fence wait during GPU reset

CVE-2026-68237: drm/amdgpu/userq: fix indefinite fence wait during GPU reset

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: fix indefinite fence wait during GPU reset

pre_reset only force-completes fences of MAPPED queues. A queue in any
other state (e.g. mid-eviction) keeps its last_fence pending; after a
GPU reset that fence never signals, so the eviction/suspend worker and
process teardown (amdgpu_evf_mgr_flush_suspend) wait on it forever and
wedge the machine:

  INFO: task kworker/6:28 blocked for more than 120 seconds.
  Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu]
  Call Trace:
   dma_fence_wait_timeout+0x7e/0x130
   amdgpu_userq_evict+0x67/0x140 [amdgpu]
   amdgpu_eviction_fence_suspend_worker+0xd8/0x160 [amdgpu]
   process_scheduled_works+0xa6/0x420

Force-complete every queue's fence regardless of state. The unmap and
mark-hung step stays gated on MAPPED, since unmapping a queue that is
not mapped is invalid.

(cherry picked from commit 9102b39fa924dcc3dc75a3137bfa9633c40b88c0)

The Linux kernel CVE team has assigned CVE-2026-68237 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.19 with commit 290f46cf5726509f55fac4c7abe9b9d311aa5a3a and fixed in 7.1.6 with commit 3085ae8695e025b39d208f288c6265edc75abbe8
	Issue introduced in 6.19 with commit 290f46cf5726509f55fac4c7abe9b9d311aa5a3a and fixed in 7.2-rc4 with commit 5d75ec2e5f1736c2f10c7d6f4565bf1bf29f29a7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68237
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3085ae8695e025b39d208f288c6265edc75abbe8
	https://git.kernel.org/stable/c/5d75ec2e5f1736c2f10c7d6f4565bf1bf29f29a7