CVE-2026-98520 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, particularly those managing systems using the drm/amdkfd component, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure proper GPU reset handling and monitor for potential PCIe transaction timeouts and NMI panics.

Why it matters

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly in environments using the drm/amdkfd component, to prevent use-after-free and multi-container gap vulnerabilities.

• Verify and apply patches to prevent use-after-free and multi-container gap vulnerabilities
• Ensure proper GPU reset handling to prevent PCIe transaction timeouts and NMI panics
• Review system configurations to prevent potential security risks

Technical summary

The Linux kernel's drm/amdkfd component has a use-after-free and multi-container gap vulnerability. The kfd_dev_mapping caches the address_space of the first /dev/kfd opener, leading to a dangling pointer and rwsem deadlock when the container exits. Only the first opener's address_space is cached, leaving VMAs created by later openers unmapped after a GPU reset. This can cause PCIe transaction timeouts and NMI panics. The vulnerability was resolved with a commit that creates a private pseudo-filesystem at module init time and allocates one anonymous inode from it. In kfd_open(), every opener's file->f_mapping is redirected to that inode's address_space.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly in environments using the drm/amdkfd component.

Recommended defensive actions

• Verify Linux kernel versions and apply patches for drm/amdkfd component
• Review system configurations and ensure proper GPU reset handling
• Monitor for potential PCIe transaction timeouts and NMI panics
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability was resolved with a commit that creates a private pseudo-filesystem at module init time and allocates one anonymous inode from it. In kfd_open(), every opener's file->f_mapping is redirected to that inode's address_space.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.