CVE-2026-97422drm/amdkfd: fix SMI event cross-process information leak
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 938a0650aae6275ba8e924685836bdee2c6aa3db builds before 5bb2dfa65d8da83e87b2a31c270bc567df69a5ca; 938a0650aae6275ba8e924685836bdee2c6aa3db builds before 92a8dba246d371fe268280e5fd74b0955688e6df | CNA record |
References
- https://git.kernel.org/stable/c/5bb2dfa65d8da83e87b2a31c270bc567df69a5ca
- https://git.kernel.org/stable/c/92a8dba246d371fe268280e5fd74b0955688e6df
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.