SB20261023175 - Improper input validation in Linux kernel amd amdgpu driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-98997)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to discard the contents of a GPU buffer shared with them by another client on the same device.

The vulnerability exists due to improper validation of buffer object memory domains in the Linux kernel amdgpu_userq_get_doorbell_index() function when processing a queue doorbell handle. A local user can supply a regular buffer object as doorbell_handle to cause it to be pinned into the doorbell domain, where TTM moves it using ttm_bo_move_null() and discards its contents. For a buffer imported on the same device, this affects the exporting client's GEM object.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/112dbe2b10d6d088a6c599980dd960dcbfa55ff0
• https://git.kernel.org/stable/c/7f7c88dbf4d543f6703e53bdeed380e886733167
• https://git.kernel.org/stable/c/8640b3f961d743d6dc0458c2b53a3af434690cc1