All vulnerabilities
CVE-2026-97429

Linux: drm/amdkfd: fix UAF race in destroy_queue_cpsch

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in090b51e2dabf88c02c0b6b25ea672a8bddfba7d5Also 41144829f4645c2bd4cb501d34d253858f750c0aCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 090b51e2dabf88c02c0b6b25ea672a8bddfba7d5LinuxCVE List
  • 41144829f4645c2bd4cb501d34d253858f750c0aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix UAF race in destroy_queue_cpsch

wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.

Text from CVE List

Affected versions 10

  • Linuxaffected: a70a93fa568b4f05aba548dadb673703eccf5480 before 090b51e2dabf88c02c0b6b25ea672a8bddfba7d5CVE List
  • Linuxaffected: a70a93fa568b4f05aba548dadb673703eccf5480 before 41144829f4645c2bd4cb501d34d253858f750c0aCVE List
  • Linuxaffected: a70a93fa568b4f05aba548dadb673703eccf5480 before d98c8032c29944e1e572e1f49a0613d364fece0fCVE List
  • Linuxaffected: a70a93fa568b4f05aba548dadb673703eccf5480 before ac081deaf16a639ea7dff2f285fe421a33c1ade0CVE List
  • Linuxaffected: 6.5CVE List
  • Linuxunaffected: all versions before 6.5CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4