PT-2026-104899

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy queue cpsch wait on destroy queue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is being destroyed flag to serialize destruction...

Linux Distros Unpatched Vulnerability : CVE-2026-97429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix UAF race in destroyqueuecpsch waitondestroyqueue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use...

Linux Distros Unpatched Vulnerability : CVE-2026-97422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT event...

Linux Distros Unpatched Vulnerability : CVE-2026-97497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't...

PT-2026-98114

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate doorbell function fails to perform bounds checking on the doorbell ID. This occurs when the doorbell ID is set to a specifi...

CVE-2026-97496: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

CVE-2026-97495

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

PT-2026-104925

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate sdma queue restore sdma id allocate sdma queue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum...

PT-2026-104860

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd smi ev enabled skips the suser privilege check when pid=0. PROCESS START, PROCESS END, and VMFAULT events are emitted with pid=0 while carrying another process's PID an...

PT-2026-104892

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Let driver decide buffer size at AMDKFD IOC GET DMABUF INFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer size is controlled by user currently. It is a potential security...

Linux Distros Unpatched Vulnerability : CVE-2026-97496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly fro...

Linux Distros Unpatched Vulnerability : CVE-2026-93823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Let driver decide buffer size at AMDKFDIOCGETDMABUFINFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer si...

CVE-2026-97422

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

CVE-2026-97429

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroyqueuecpsch waitondestroyqueue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use isbeingdestroyed flag to serialize destruction...

CVE-2026-97497: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

Linux Distros Unpatched Vulnerability : CVE-2026-97495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds...

SUSE CVE-2026-89811

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES Micro Engine Scheduler does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race conditio...

ROS-20260918-73-0008

The vulnerability of the kfdeventpageset function in the drivers/gpu/drm/amd/amdkfd/kfdevents.c module of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to out-of-buffer writing. Exploiting this vulnerability could allow an attacker to...

SUSE CVE-2026-89807

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

SUSE CVE-2026-89808

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...