Use-After-Free Race Condition in AMDKFD Linux Kernel Driver

Executive Summary

This vulnerability is a use-after-free (UAF) race condition in the Linux kernel's AMDKFD driver. It occurs in the destroy_queue_cpsch function where wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy operation to free the queue while it is still in use. A new flag is_add_being_destroyed is introduced to serialize destruction and prevent the race.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/amdkfd component and involves a UAF race condition in queue destruction. Detection requires checking kernel logs for related errors or kernel crashes involving amdkfd or queue handling. Commands like dmesg | grep amdkfd or journalctl -k | grep amdkfd may help identify issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. Attackers might trigger the race condition to cause memory corruption, leading to denial-of-service or arbitrary code execution on affected systems running the vulnerable Linux kernel.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a use-after-free (UAF) race condition in the Linux kernel's AMDKFD driver, which could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety issues.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-97429. If immediate patching is not possible, consider disabling the affected amdkfd module if not required, but this may impact functionality.

Useful 0 Not Useful 0