All vulnerabilities
CVE-2026-98910

Linux: drm/amdkfd: Unwind debug trap enable on copy_to_user failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in641be20110cdfb6d921605adb42a764a0fccac54Also 656a40bdc20def58790b8512e6000195436d8855, 1b39f46eec2f907417d4955bb88434170f94a8d8 and 4 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 641be20110cdfb6d921605adb42a764a0fccac54LinuxCVE List
  • 656a40bdc20def58790b8512e6000195436d8855LinuxCVE List
  • 1b39f46eec2f907417d4955bb88434170f94a8d8LinuxCVE List
  • 01112e241e37f9ac98b6f418d93ce2e0b87b7ee0LinuxCVE List
  • 6.6.158LinuxCVE List
  • 6.12.111LinuxCVE List
Show all 7 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Unwind debug trap enable on copy_to_user failure

If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE.

On copy_to_user failure, deactivate the trap and undo the rest of the enable setup before returning.

Text from CVE List

Affected versions 11

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 641be20110cdfb6d921605adb42a764a0fccac54CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 656a40bdc20def58790b8512e6000195436d8855CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1b39f46eec2f907417d4955bb88434170f94a8d8CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 01112e241e37f9ac98b6f418d93ce2e0b87b7ee0CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4