CVE-2026-97429 Linux CVE debrief

Who should care

Linux kernel maintainers and users, Linux kernel developers, Linux distribution maintainers, and security teams responsible for Linux kernel security should assess exposure and prioritize patching. They should verify Linux kernel configurations and update if necessary. Monitoring Linux kernel for potential exploitation attempts is recommended.

Why it matters

CVE-2026-97429 is a high-severity vulnerability in the Linux kernel's drm/amdkfd component. Defenders should assess exposure and prioritize patching.

• Potential UAF exploitation requires verification from official sources
• Defenders should verify Linux kernel configurations and update if necessary
• Monitoring Linux kernel for potential exploitation attempts is recommended

Technical summary

The vulnerability occurs in the destroy_queue_cpsch function, where the wait_on_destroy_queue function drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. To fix this issue, a is_being_destroyed flag is used to serialize destruction. Linux kernel maintainers and users should assess exposure and prioritize patching. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. Defenders should verify Linux kernel configurations and update if necessary. Monitoring Linux kernel for potential exploitation attempts is recommended.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize patching.

Recommended defensive actions

• Assess exposure and apply patches for Linux kernel
• Review Linux kernel configurations and update if necessary
• Monitor Linux kernel for potential exploitation attempts
• Verify Linux kernel for potential exploitation attempts
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems
• Check relevant monitoring and detection logs

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. Linux kernel maintainers and users should verify Linux kernel configurations and update if necessary. Monitoring Linux kernel for potential exploitation attempts is recommended. The vulnerability occurs in the destroy_queue_cpsch function, where the wait_on_destroy_queue function drops locks to wait for queue resume, allowing a concurrent destroy to free the queue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.