UBUNTU-CVE-2026-98910: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable() fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE. On copytouser failure, deactivate the trap and undo the rest of the enable setup before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
On copy_to_user failure in kfd_dbg_trap_enable(), deactivate the debug trap and undo the enable setup: clear debug_trap_enabled, release the extra process reference, and close the debug event file before returning -EFAULT.
Event History
Frequently Asked Questions
Which systems and workloads are relevant to this issue?
The issue applies to the listed Ubuntu kernel packages when the AMD KFD debug-trap enable path is used. Workloads that do not enable AMD KFD debug traps do not exercise the described failure path.
What condition triggers the inconsistent state?
The condition occurs when enabling a debug trap has already activated the trap and completed related setup, but copying runtime information to userspace fails. The operation then returns -EFAULT without undoing the partially completed enable state.
What is the practical impact after the failure?
A failed enable can leave the debug trap active, retain an extra process reference, and leave the debug event file open. This inconsistent state and refcount imbalance can cause later disable or enable operations to break.