CVE-2024-26986

What it actually does

A memory leak occurs due to an unreleased mmget reference on an error path in KFD process creation during GPU reset, leading to gradual kernel memory exhaustion.

Why it matters to the business

Systems running affected Linux kernels with AMD GPUs may experience memory pressure or crashes over time if processes are created during resets, potentially disrupting GPU-accelerated workloads.

How an attack unfolds

An attacker with local access could repeatedly trigger KFD process creation while inducing GPU resets to leak memory, but the vulnerability requires specific timing and local privileges; no widespread exploitation reported.

How to fix it

Upgrade to a fixed kernel version such as commit aa02d43367a9adf8c85fb382fea4171fb266c8d0 in the Linux stable repository.

How to confirm the fix worked

Verify the kernel source includes the fix for the memory leak in create_process error handling path.

Typical attack path

1. Obtain local access to the system
2. Trigger GPU reset condition
3. Attempt KFD process creation to hit error path
4. Repeat to accumulate memory leaks

How to detect it

Look for kernel logs indicating process creation failures during GPU resets and monitor memory usage patterns for unexplained leaks.

What your security team should do

• Apply the kernel patch or update to fixed version immediately
• Monitor for unusual memory usage on systems with AMD GPUs
• Restrict local access to mitigate potential abuse