CVE-2026-97496 Linux CVE debrief

Who should care

Linux kernel developers and administrators should assess exposure and prioritize patching to prevent potential exploitation. They should review the official advisory and assess their system's exposure. Additionally, they should implement additional security measures to protect against potential attacks and monitor system logs for potential exploitation attempts.

Why it matters

CVE-2026-97496 is a high-severity Linux kernel vulnerability that can be exploited to leak adjacent kernel memory, potentially exposing sensitive information. Linux kernel developers and administrators should assess exposure and prioritize patching to prevent potential exploitation.

• Potential exposure of sensitive kernel memory
• Possible leak of adjacent kernel memory
• Need for patching to prevent exploitation

Technical summary

The get_wave_state() function in the Linux kernel's drm/amdkfd component trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD, which are written by GPU microcode and fully attacker-controlled on the CRIU-restore path. This leads to an unbounded copy_to_user() operation that can leak adjacent GTT/kernel memory. The fix clamps cp_hqd_cntl_stack_size to the actual allocated buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the clamped size before performing arithmetic and copy_to_user(). This ensures that the kernel does not read beyond the allocated kernel BO regardless of attacker-supplied MQD field values. The vulnerability has a high CVSS score of 7.1 and a

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patch to fix the vulnerability
• Monitor system logs for potential exploitation attempts
• Implement additional security measures to protect against potential attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected products. The Linux kernel patch notes also provide details on the fix. However, the patch notes do not provide explicit evidence of the vulnerability's impact on specific systems or networks. To verify the vulnerability, defenders should review the official advisory and assess their system's exposure. The vulnerability has been resolved through a fix that clamps cp_hqd_cntl_stack_size and cp_h

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.