CVE-2026-97497 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel deployments using the drm/amdkfd component, especially in environments where CRIU is utilized, should assess exposure and validate the patch.

Why it matters

Defenders should prioritize assessing exposure and validating the patch for Linux kernel deployments using the drm/amdkfd component, especially in environments where CRIU is utilized, due to a high-severity vulnerability involving a bounds checking issue.

• Verify patch deployment for Linux kernel drm/amdkfd component
• Assess exposure in CRIU environments
• Validate sdma queue id value bounds checking

Technical summary

The Linux kernel drm/amdkfd component has a vulnerability due to a lack of bounds checking in the allocate_sdma_queue function. This could potentially lead to security issues if the sdma queue id value is not properly validated. The vulnerability involves a bounds checking issue in the allocate_sdma_queue function, which could potentially lead to security impacts if exploited. The issue arises from the lack of bounds checking for the sdma queue id value when it is specified, such as when used by CRIU. This could allow for unintended behavior or security issues if the value is not properly validated. Defenders should prioritize assessing exposure and validating the patch for Linux kernel deployments using the

Defensive priority

Defenders should prioritize assessing exposure and validating the patch for Linux kernel deployments using the drm/amdkfd component, especially in environments where CRIU is utilized.

Recommended defensive actions

• Assess exposure for Linux kernel deployments using the drm/amdkfd component
• Validate the patch for the allocate_sdma_queue function
• Verify the sdma queue id value is properly validated in CRIU environments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, specific details about exploitation or impact are limited, and further verification is required to understand the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.