Cloudanix VulnDB

CVE-2026-98910

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux GPU debugging code can leave the system partly enabled after an error, risking crashes or memory problems on machines that use advanced graphics debugging.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Failure path in kfd_dbg_trap_enable leaves the trap activated, debug_trap_enabled set, an extra process reference held, and the debug event file open, creating refcount imbalance and inconsistent trap state that later DISABLE/ENABLE operations can mishandle.

Why it matters to the business

Systems using AMD GPU debug features may experience kernel instability, crashes, or resource accounting errors during debugging sessions, increasing downtime risk for compute workloads that rely on the driver.

How an attack unfolds

An attacker with access to the KFD debug interface triggers kfd_dbg_trap_enable followed by a copy_to_user failure; the missing unwind leaves dangling state that subsequent debug operations can abuse to corrupt kernel memory accounting or trigger use-after-free conditions.

How to fix it

Apply the upstream kernel patch that adds proper unwind on copy_to_user failure in kfd_dbg_trap_enable; rebuild and deploy the updated kernel image across all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the drm/amdkfd source for the unwind logic after copy_to_user failure; run kernel debug trap enable/disable stress tests that simulate copy failures and verify no refcount warnings or trap state leaks occur.

Typical attack path

  1. Obtain local access and open the KFD debug trap device
  2. Invoke kfd_dbg_trap_enable and force copy_to_user to fail
  3. Observe inconsistent trap state and refcount imbalance
  4. Issue follow-on ENABLE/DISABLE or process exit operations to trigger memory corruption

How to detect it

Review kernel logs for amdkfd-related warnings about trap state or refcount imbalance after debug sessions; inspect process exit paths and debug event file descriptors for unexpected leaks following failed trap enable attempts.

What your security team should do

  • Prioritize kernel update on any system exposing AMD GPU debug interfaces
  • Restrict access to /dev/kfd debug functionality via LSM or device ACLs until patched
  • Monitor kernel logs for amdkfd refcount or trap state warnings

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE. On copy_to_user failure, deactivate the trap and undo the rest of the enable setup before returning.

Affected packages

Ecosystem Package Introduced Fixed