UBUNTU-CVE-2026-97422: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled() skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfdsmieventadd() for these events so the existing per-client filter restricts delivery to the owning process or CAPSYSADMIN subscribers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who can observe other users' GPU workloads on an affected system?
Any user able to access /dev/kfd through membership in the render group can receive the affected events for other processes. Under the corrected behavior, event delivery is limited to the owning process or subscribers with CAP_SYS_ADMIN.
What access does an attacker need?
Exploitation requires local access and low privileges sufficient to use /dev/kfd, such as render-group membership. It does not require user interaction.
What information is exposed through the affected events?
PROCESS_START, PROCESS_END, and VMFAULT events can disclose another process's PID and command name. These events were emitted with pid=0, bypassing the expected per-client filtering.