CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()
A reference counting error in the Linux kernel's AMD node driver can lead to use-after-free, allowing local attackers to cause denial of service or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97946?
CVE-2026-97946 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/amd_node: Fix PCI device reference counting in amd_smn_init()
The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the search is complete.
Use the __free() cleanup macro to ensure the refcount is decremented when the temporary pointer goes out of scope.
Additionally, increment the refcount when caching a root pointer. This ensures the in-use refcount is separate from the temporary search refcounting.
Finally, drop the redundant "root = NULL" before the second search loop. The pci_get_class() iterator always decrements the refcount of its "from" argument, so the first loop can only fall through with "root" already NULL.
Which versions are affected by CVE-2026-97946?
How do I fix CVE-2026-97946?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-97946 being exploited?
There is no known exploitation of CVE-2026-97946 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-97946, DEBIAN-CVE-2026-97946, GHSA-vfm8-xw8f-q53w, UBUNTU-CVE-2026-97946.