CVE-2026-97422 Linux CVE debrief

Who should care

System administrators and security teams managing Linux systems with the drm/amdkfd component should assess exposure and apply patches. Users with access to /dev/kfd, particularly those in the render group, should be monitored and managed to prevent unauthorized access to GPU workload information.

Why it matters

The Linux kernel drm/amdkfd component vulnerability allows for cross-process information leaks of SMI events, potentially enabling unauthorized monitoring of GPU workloads. Defenders should prioritize patching, monitoring, and access management to mitigate this issue.

• Potential unauthorized monitoring of GPU workloads by users in the render group.
• Information leak of SMI events across processes.
• Need for verification and application of official kernel patches.
• Potential for elevated privileges or access to sensitive GPU workload information.

Technical summary

The drm/amdkfd component of the Linux kernel has a vulnerability that allows for cross-process information leaks of SMI events. The kfd_smi_ev_enabled() function does not properly check privileges when the process ID is 0, leading to potential monitoring of all GPU workloads by users in the render group. Official kernel patches have been provided to address this issue. Affected systems should be identified and patched promptly to prevent unauthorized access to GPU workload information. Additionally, monitoring and restricting access to /dev/kfd are recommended to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying and applying patches for this vulnerability, particularly for systems utilizing the Linux kernel with the drm/amdkfd component. Monitoring and restricting access to /dev/kfd, as well as ensuring that users in the render group are properly managed, are also recommended.

Recommended defensive actions

• Verify and apply the official patches for the Linux kernel drm/amdkfd component.
• Restrict access to /dev/kfd to authorized users only.
• Monitor GPU workloads and manage users in the render group.
• Review system configurations and user permissions for /dev/kfd access.
• Perform vulnerability scanning to identify potential exposures.
• Implement additional monitoring to detect anomalous GPU workload activity.
• Review and update incident response plans to address potential exploitation.

Evidence notes

The CVE record and source references indicate that this vulnerability has been resolved in the Linux kernel. The issue allows for cross-process information leaks of SMI events. Official references are provided to the kernel patches addressing this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.