SB2026102408 - Incomplete cleanup in Linux kernel amd amdkfd driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incomplete cleanup (CVE-ID: CVE-2026-98910)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt subsequent GPU debug trap enable and disable operations.

The vulnerability exists due to incomplete cleanup in the Linux kernel AMD KFD kfd_dbg_trap_enable() function when copying runtime information to userspace fails. A local user can trigger a copy_to_user() failure during debug trap setup to leave inconsistent trap state and an unbalanced process reference count, potentially disrupting subsequent debug trap enable and disable operations.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/01112e241e37f9ac98b6f418d93ce2e0b87b7ee0
• https://git.kernel.org/stable/c/1b39f46eec2f907417d4955bb88434170f94a8d8
• https://git.kernel.org/stable/c/641be20110cdfb6d921605adb42a764a0fccac54
• https://git.kernel.org/stable/c/656a40bdc20def58790b8512e6000195436d8855