CVE-2026-97429: drm/amdkfd: fix UAF race in destroy_queue_cpsch
drm/amdkfd: fix UAF race in destroyqueuecpsch
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In drm/amdkfd, use the is_being_destroyed flag to serialize queue destruction and prevent concurrent destroy_queue_cpsch operations from freeing a queue while wait_on_destroy_queue() is waiting.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The race requires concurrent queue-destruction activity while destroy_queue_cpsch is waiting for a queue to resume. During that wait, locks are dropped, allowing another destroy operation to free the queue.
What is the impact of successful exploitation?
The race can result in a use-after-free of a queue object. The provided information does not specify resulting privileges, code execution, denial-of-service behavior, or other concrete impact.
What is the remediation?
Apply a Linux kernel update containing the fix. The fix uses the is_being_destroyed flag to serialize queue destruction and prevent concurrent destruction from freeing the queue during the wait.
Are there temporary mitigations if an updated kernel cannot be deployed immediately?
No temporary configuration workaround is provided. Reducing or avoiding concurrent queue destruction may reduce exposure, but this is an inference from the race condition rather than a documented mitigation.