CVE-2026-98997 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, system administrators managing Linux systems, and developers working with the drm/amdgpu/userq component should be aware of this vulnerability and take necessary actions to prevent potential data loss or unauthorized access.

Why it matters

CVE-2026-98997 is a Linux kernel vulnerability in drm/amdgpu/userq that allows clients to affect shared buffers. Defenders should verify kernel versions, apply patches, and monitor system logs to prevent data loss or unauthorized access.

• Potential data loss due to TTM moving regular BOs with ttm_bo_move_null()
• Unauthorized access to buffers shared by another client on the same device
• Need for verification of Linux kernel versions and application of patches

Technical summary

The Linux kernel vulnerability CVE-2026-98997 was resolved in the drm/amdgpu/userq component. The issue allowed clients to affect buffers shared by another client on the same device by passing any BO as doorbell_handle to amdgpu_userq_get_doorbell_index(). The fix ensures that only doorbell BOs are accepted as queue doorbell. Defenders should prioritize verifying Linux kernel versions and applying patches to prevent potential data loss or unauthorized access. The vulnerability arises from amdgpu_userq_get_doorbell_index() pinning any BO passed as doorbell_handle into the doorbell domain. For regular BOs, TTM moves them with ttm_bo_move_null(), causing loss of contents.

Defensive priority

Defenders should prioritize verifying Linux kernel versions and applying patches to prevent potential data loss or unauthorized access.

Recommended defensive actions

• Verify Linux kernel versions and apply patches to prevent potential data loss or unauthorized access
• Review system configurations and ensure doorbell BOs are properly created and managed
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability and its resolution. Three source references are provided, pointing to specific commits in the Linux kernel repository. Defenders should verify Linux kernel versions, review system configurations, and monitor system logs to prevent potential data loss or unauthorized access. The vulnerability allows clients to affect shared buffers, and its resolution ensures that only doorbell BOs are accepted as queue doorbell. Evidence is limited to publicly available details, and a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.