CVE-2026-97422 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix SMI event cross-process information leak
kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads.
Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the AMD Kernel Fusion Driver (amdkfd), contained a critical logic flaw in its System Management Interface event handling mechanism. This vulnerability allowed for an unauthorized cross-process information leak regarding GPU workload details. The core of the issue resided in the kfd_smi_ev_enabled function, which is responsible for determining whether specific SMI events should be emitted to user-space applications. Under normal circumstances, this function enforces strict privilege checks to ensure that only authorized processes can access sensitive system management data. However, a logical error was introduced where the suser privilege check was inadvertently skipped when the process identifier passed as an argument was zero. This oversight created a significant security gap in the kernel's access control model for GPU-related events.
The operational impact of this flaw is substantial because certain critical events, including PROCESS_START, PROCESS_END, and VMFAULT, are emitted with a pid value of zero during their generation phase. Despite being flagged as originating from process zero, these event structures actually contain detailed information about other active processes, such as the actual target PID and command names associated with GPU workloads. Consequently, any user account belonging to the render group on the system could subscribe to /dev/kfd devices and monitor all GPU activities across the entire machine. This effectively bypassed isolation boundaries intended by the kernel, allowing non-privileged users to gather intelligence about other processes' execution context, which can be leveraged for further attacks or surveillance within a multi-user environment.
From a vulnerability classification perspective, this issue aligns with CWE-200: Information Exposure and CWE-787: Out-of-bounds Read in certain contexts where the logic error leads to accessing data outside intended boundaries of privilege. In terms of the MITRE ATT&CK framework for Linux, this behavior corresponds to T1059.004: Unix Shell Command Execution through indirect means or more accurately T1083: File and Directory Discovery if used to enumerate running processes, but primarily it falls under T1071: Application Layer Protocol abuse where the /dev/kfd interface is abused as a covert channel for information gathering. The vulnerability represents an authorization bypass due to improper privilege validation logic within kernel-space drivers.
The resolution implemented by the Linux kernel maintainers addresses this flaw by modifying the kfd_smi_event_add function to explicitly pass the target process PID rather than relying on potentially misleading zero values during event emission. This change ensures that the existing per-client filter mechanisms can correctly evaluate whether the requesting client has permission to receive specific events based on ownership or administrative privileges. By enforcing proper association between the emitting context and the actual owning process, the kernel restores the integrity of its access control lists for GPU management interfaces.
To mitigate similar risks in related systems, administrators should ensure that their Linux kernels are updated to versions containing this patch. Additionally, strict adherence to principle of least privilege is recommended when configuring render group memberships on multi-user servers or workstations where sensitive data processing occurs via GPUs. Security auditors and developers reviewing kernel drivers for DRM subsystems should pay close attention to how process identifiers are handled in event notification loops, ensuring that zero-valued PIDs do not inadvertently bypass security checks designed to protect inter-process isolation boundaries.