CVE-2026-97495: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

CVE-2026-97495

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

Linux Distros Unpatched Vulnerability : CVE-2026-93823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Let driver decide buffer size at AMDKFDIOCGETDMABUFINFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer si...

Linux Distros Unpatched Vulnerability : CVE-2026-97497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't...

CVE-2026-97422

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

CVE-2026-93823

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Let driver decide buffer size at AMDKFDIOCGETDMABUFINFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer size is controlled by user currently. It is a potential security issue...

CVE-2026-97497

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

CVE-2026-97422: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

PT-2026-98063

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF race condition exists in the drm/amdkfd component. The wait on destroy queue function drops locks while waiting for a queue to resume, which allows a concurrent...

PT-2026-98116

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate sdma queue function fails to perform bounds-checking on the restore sdma id variable. This variable, which allows the...

CVE-2026-97496: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

PT-2026-104988

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocate doorbell allocated doorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFD MAX NUM OF QUEUES PER...

CVE-2026-97497: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

PT-2026-104899

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy queue cpsch wait on destroy queue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is being destroyed flag to serialize destruction...

PT-2026-104983

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in get wave state The get wave state function for v9 trusts cp hqd cntl stack size and cp hqd cntl stack offset values read directly from the MQD, which are written by GPU microcode and fully...

CVE-2026-97496

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

PT-2026-98056

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the drm/amdkfd component where the kfd smi ev enabled function skips the suser privilege check when the pid variable is 0. This allows any user in the rende...

PT-2026-98114

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate doorbell function fails to perform bounds checking on the doorbell ID. This occurs when the doorbell ID is set to a specifi...

CVE-2026-93823: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Let driver decide buffer size at AMDKFDIOCGETDMABUFINFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer size is controlled by user currently. It is a potential security issue...

PT-2026-104925

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate sdma queue restore sdma id allocate sdma queue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum...