Riskcovery

CVE-2026-97422

drm/amdkfd: fix SMI event cross-process information leak

State
Published
Severity
Not scored
Published
Sep 24, 2026
Updated
Oct 30, 2026
Reserved
Sep 24, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix SMI event cross-process information leak

kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads.

Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 938a0650aae6275ba8e924685836bdee2c6aa3db to before b8151aeb4f34e913315058c192f78fea2223f36aAffected
  • 938a0650aae6275ba8e924685836bdee2c6aa3db to before 6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922aAffected
  • 938a0650aae6275ba8e924685836bdee2c6aa3db to before 470319a893f616ef661a63e825a8e1b9b6eddb91Affected
  • 938a0650aae6275ba8e924685836bdee2c6aa3db to before 5bb2dfa65d8da83e87b2a31c270bc567df69a5caAffected
  • 938a0650aae6275ba8e924685836bdee2c6aa3db to before 92a8dba246d371fe268280e5fd74b0955688e6dfAffected
LinuxLinux
  • 5.9Affected
  • before 5.9Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.