CVE-2026-97422: drm/amdkfd: fix SMI event cross-process information leak
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix SMI event cross-process information leak
kfdsmievenabled() skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads.
Pass the target process PID into kfdsmieventadd() for these events so the existing per-client filter restricts delivery to the owning process or CAPSYSADMIN subscribers.
Affected Software
Event History
Frequently Asked Questions
Who can observe other processes' GPU workload information?
Any user who can access /dev/kfd through membership in the render group can receive the affected SMI events. The leaked event data includes another process's PID and command name.
Which event types are involved in the cross-process disclosure?
PROCESS_START, PROCESS_END, and VMFAULT events are affected. These events were emitted with pid=0, which bypassed the existing privilege check and per-client filtering behavior.
What access does an attacker need to exploit this issue?
The attacker needs local access to /dev/kfd as a user in the render group. No CAP_SYS_ADMIN privilege is required for the vulnerable behavior.
How does the fix restrict event delivery?
The fix passes the target process PID when adding these SMI events. This allows the existing per-client filter to deliver them only to the owning process or to CAP_SYS_ADMIN subscribers.