CVE-2026-97422
Received Received - Intake

AMDKFD SMI Event Information Leak in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97422
EUVD
EUVD-2026-86035

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a flaw in the AMDKFD driver allows information leaks. The function kfd_smi_ev_enabled skips privilege checks when pid=0, causing sensitive GPU workload data to be exposed to unauthorized users in the render group.

Detection Guidance

This vulnerability involves information leaks in GPU workloads via /dev/kfd. To detect it, check for unauthorized access to GPU event logs or monitoring of processes not owned by the user. Look for unexpected SMI events with cross-process PID and command name data. Inspect /dev/kfd permissions and user activity logs for render group members accessing unrelated processes.

Impact Analysis

An attacker in the render group could monitor all GPU workloads on the system, potentially accessing sensitive data processed by other applications. This could lead to unauthorized information disclosure or data theft.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive personal or health information processed on the GPU. Organizations may face compliance violations and penalties.

Mitigation Strategies

Apply the Linux kernel patch that fixes the SMI event cross-process information leak. Ensure only authorized users have access to /dev/kfd by restricting render group membership. Monitor GPU workloads for suspicious activity and restrict CAP_SYS_ADMIN privileges to trusted administrators.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart