CVE-2026-80703

What it actually does

Missing authorization check in KFD_IOC_DBG_TRAP_DISABLE allows any process with /dev/kfd access to terminate another process's active GPU debug session without ownership or ptrace rights.

Why it matters to the business

Local users on AMD GPU systems can disrupt debugging workflows or security analysis sessions, potentially interfering with development, testing, or incident response activities.

How an attack unfolds

An attacker obtains a file descriptor for /dev/kfd and directly issues the KFD_IOC_DBG_TRAP_DISABLE ioctl against a target process debug session, bypassing the absent ownership and ptrace authorization checks that the patch now enforces.

How to fix it

Update the Linux kernel to a version containing commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5 or later equivalent backports; restrict unprivileged access to /dev/kfd via device permissions or LSM policy until patched.

How to confirm the fix worked

Confirm presence of the authorization check in the KFD_IOC_DBG_TRAP_DISABLE handler in the running kernel source or binary; verify that attempts to disable another process debug session are now rejected for non-owners.

Typical attack path

1. Gain local shell access on a system exposing /dev/kfd
2. Open /dev/kfd and enumerate or guess target debug session identifiers
3. Issue KFD_IOC_DBG_TRAP_DISABLE ioctl without satisfying ownership or ptrace requirements
4. Observe termination of the victim debug session

How to detect it

Inspect kernel audit logs or eBPF traces for unexpected KFD_IOC_DBG_TRAP_DISABLE ioctls originating from non-debugger processes; correlate with process creation events around debug session lifetimes.

What your security team should do

• Apply the referenced kernel patch or distribution update with highest priority on systems exposing AMD KFD
• Review and tighten permissions on /dev/kfd to limit access to trusted processes only
• Monitor kernel update channels for backports to supported LTS branches