UBUNTU-CVE-2026-97497: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value. Confirm it's less than the maximum number of queues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate that the specified SDMA queue ID is less than the maximum number of queues before allocating or restoring the SDMA queue.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and high privileges are required. No user interaction is required.
Which systems are most relevant to triage?
The issue is in the Linux kernel drm/amdkfd component and involves specifying an SDMA queue ID through functionality used by CRIU. Ubuntu lists linux, linux-fips, and the AWS, Azure, and GCP kernel variants, including their FIPS variants, as affected software.
What is the impact of successful exploitation?
The supplied severity vector rates confidentiality, integrity, and availability impact as high within the vulnerable component's security scope. The vulnerability results from failing to verify that a requested SDMA queue ID is below the maximum queue count.