CVE-2026-98910: drm/amdkfd: Unwind debug trap enable on copy_to_user failure
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Unwind debug trap enable on copytouser failure
If kfddbgtrapenable() fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE.
On copytouser failure, deactivate the trap and undo the rest of the enable setup before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
When kfd_dbg_trap_enable() fails while copying runtime_info to userspace, deactivate the trap, clear debug_trap_enabled, release the extra process reference, close the debug event file, and return -EFAULT to fully unwind the enable setup.