CVE-2026-97422 drm/amdkfd: fix SMI event cross-process information leak
A local user in the render group can monitor all GPU workloads and leak process information due to a missing privilege check in the AMD KFD driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97422?
CVE-2026-97422 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix SMI event cross-process information leak
kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads.
Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers.
Which versions are affected by CVE-2026-97422?
How do I fix CVE-2026-97422?
Apply the vendor's patch.
Is CVE-2026-97422 being exploited?
There is no known exploitation of CVE-2026-97422 in the wild and no public exploit code.
Sources
Also known as AZL-103589, BELL-CVE-2026-97422, DEBIAN-CVE-2026-97422, GHSA-p54q-xhjq-3xh7, UBUNTU-CVE-2026-97422.