CVE-2023-51042 is a high severity (CVSS 7.8) use after free in the Linux kernel's amdgpu driver, in amdgpu_cs_wait_all_fences. It affects kernels before 6.4.12. Update to 6.4.12 or later, or to a distribution kernel that has backported the fix, and check your vendor's advisory.
What's affected
The NVD description says the Linux kernel before 6.4.12 has a fence use after free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c. The upstream 6.4.12 changelog and a kernel commit are the referenced fix sources.
Distribution kernels usually carry their own version numbers and backport fixes, so a kernel that reports an older number may still be patched. Systems without the amdgpu driver loaded are not exposed through this code path, though I did not confirm that wording in the advisory, so verify it for your build.
CVSS for this entry is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Start with the running kernel and whether the driver is present.
uname -r
lsmod | grep amdgpu
If amdgpu is loaded and the kernel is older than 6.4.12 and not a vendor build that lists the fix, treat it as exposed. For distribution kernels, search your vendor's security tracker for CVE-2023-51042 and compare the package version.
What to do now
- Run the commands above on hosts with AMD graphics hardware, including workstations and GPU servers.
- Check your distribution's tracker for a fixed kernel package.
- Install the updated kernel and reboot into it.
- Confirm with uname -r after the reboot, and keep local user access on shared GPU hosts to people who need it.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-416 is use after free. Code keeps using a pointer after the memory behind it has been released, so it reads or writes memory that may now belong to something else. Fixes correct the object lifetime so the memory is not touched after release.
The CWE is CWE-416, use after free. The NVD vector is local with low privileges, which means an attacker needs an account on the machine already. Impact is high on all three properties if the flaw is turned into a working attack.
That shapes priority. A multi-user server, a shared workstation or a container host where untrusted code runs should patch first. A single-user laptop is a lower concern, though the update is still routine.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a remote attacker able to use this?
No. The vector is local, so the attacker needs local access first.
Does my distribution kernel count as fixed at 6.4.12?
Not necessarily by number. Check your vendor's advisory for the package that includes the fix.
Sources
Last reviewed: 19 October 2026.
