{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98520 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98520 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98520 and fix it if it is affected.\n\nWhat it is: CVE-2026-98520 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98520 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98520/ (Markdown: https://insights.sbomify.com/CVE-2026-98520/index.md)","id":"CVE-2026-98520","markdown":"https://insights.sbomify.com/CVE-2026-98520/index.md","name":"CVE-2026-98520","record":{"aliases":["DEBIAN-CVE-2026-98520","GHSA-x886-mwj9-qhhg","UBUNTU-CVE-2026-98520"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A use-after-free in the AMD KFD driver allows local attackers to cause system hangs or potentially escalate privileges via GPU reset paths in multi-container environments.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n\nkfd_dev_mapping caches the address_space of the first /dev/kfd opener\nso that the GPU reset path can call unmap_mapping_range() to zap all\nuserspace mappings of doorbell and MMIO ranges.  This design has two\nbugs that both manifest under SRIOV with multiple containers:\n\n1. Use-after-free / rwsem deadlock.  The cached pointer refers to an\n   inode owned by the first opener's container.  When that container\n   exits and its inode is released, kfd_dev_mapping becomes a dangling\n   pointer.  A subsequent GPU reset dereferences it inside\n   unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,\n   causing a hard hang observable as an uninterruptible rwsem wait.\n\n2. Multi-container gap.  Only the first opener's address_space is cached;\n   VMAs created by later openers live in a different address_space and\n   are never reached by unmap_mapping_range().  After a GPU reset those\n   stale mappings keep doorbell and MMIO pages accessible to guest\n   userspace with no GPU behind them, risking PCIe transaction timeouts\n   and NMI panics.\n\nFix both bugs with the same approach used by DRM core (drm_drv.c):\ncreate a private pseudo-filesystem at module init time and allocate one\nanonymous inode from it.  In kfd_open() redirect every opener's\nfile-\u003ef_mapping to that inode's address_space.  The inode is\nmodule-owned, lives exactly as long as the amdgpu module, and collects\nVMAs from all openers in one address_space.  A single\nunmap_mapping_range() call in the reset path then correctly reaches\nevery container's mappings with no dangling pointer risk.\n\nThe hang manifests as an NMI backtrace on the GPU reset workqueue stuck\nspinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem:\n\n  Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_wait+0x1f/0x40\n   __pv_queued_spin_lock_slowpath+0x31d/0x3a0\n   _raw_spin_lock_irq+0x51/0x80\n   rwsem_down_read_slowpath+0xb3/0x550\n   down_read+0x48/0xd0\n   unmap_mapping_range+0x71/0x140\n   kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu]\n   amdgpu_amdkfd_clear_kfd_mapping+0xd8/0x190 [amdgpu]\n   amdgpu_device_gpu_recover+0x232/0x450 [amdgpu]\n   xgpu_ai_mailbox_flr_work+0xb5/0xc0 [amdgpu]\n   process_one_work+0x18e/0x3e0\n   worker_thread+0x2e3/0x420\n   kthread+0x10a/0x230\n\n(cherry picked from commit 1128b4a52de1572e87431de837fd9850cb99542c)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping","id":"CVE-2026-98520","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"drm/i915: fix incorrect RCU teardown order","id":"CVE-2026-98521"},"packages":[],"prev":{"headline":"drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()","id":"CVE-2026-98519"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-24","vendors":["Linux"]},"summary":"A use-after-free in the AMD KFD driver allows local attackers to cause system hangs or potentially escalate privileges via GPU reset paths in multi-container environments.","url":"https://insights.sbomify.com/CVE-2026-98520/"}