CVE-2026-97429: drm/amdkfd: fix UAF race in destroy_queue_cpsch
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix UAF race in destroyqueuecpsch
waitondestroyqueue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use isbeingdestroyed flag to serialize destruction.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The race requires concurrent queue-destruction activity while destroy_queue_cpsch is waiting for a queue to resume. During that wait, locks are dropped, allowing another destroy operation to free the queue.
What is the impact of successful exploitation?
The race can result in a use-after-free of a queue object. The provided information does not specify resulting privileges, code execution, denial-of-service behavior, or other concrete impact.
What is the remediation?
Apply a Linux kernel update containing the fix. The fix uses the is_being_destroyed flag to serialize queue destruction and prevent concurrent destruction from freeing the queue during the wait.
Are there temporary mitigations if an updated kernel cannot be deployed immediately?
No temporary configuration workaround is provided. Reducing or avoiding concurrent queue destruction may reduce exposure, but this is an inference from the race condition rather than a documented mitigation.