CVE-2026-97429 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix UAF race in destroy_queue_cpsch
wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel's Direct Rendering Manager subsystem, specifically within the AMD Kernel Fusion Driver component, contained a critical race condition vulnerability identified as a use-after-free issue in the function responsible for destroying compute queues. This flaw arises from an improper synchronization mechanism during the lifecycle management of hardware queue structures used by the Graphics Processing Unit to execute computational tasks. The core technical deficiency lies in the wait_on_destroy_queue implementation, which temporarily releases necessary kernel locks while waiting for a queue to resume operation or reach a specific state. By dropping these locks, the function creates a window where concurrent execution paths can interact with the same memory object without mutual exclusion guarantees.
During this unlocked interval, another thread executing the destroy_queue_cpsch routine may proceed to free the underlying queue structure and release its associated kernel resources. If the original thread subsequently attempts to access or manipulate the now-freed memory upon resuming from its wait state, it results in a use-after-free condition. This type of vulnerability is classified under CWE-416, which describes accessing freed memory that can lead to unpredictable behavior, system crashes, or potential exploitation for arbitrary code execution if an attacker can control the data written into the reclaimed memory region before it is reallocated for other purposes.
The operational impact of this race condition includes kernel panics and system instability due to invalid memory accesses within the critical path of GPU command processing. In a multi-user environment where multiple processes may submit compute jobs concurrently, the likelihood of triggering this race increases significantly under high load conditions. An attacker with local access could potentially exploit this timing window to cause a denial of service by crashing the kernel or, in more complex scenarios involving heap grooming techniques, escalate privileges by controlling the contents of the freed memory block when it is reallocated for sensitive structures such as file descriptors or security tokens.
To mitigate this vulnerability, developers implemented a serialization mechanism using an is_being_destroyed flag within the queue structure. This boolean indicator ensures that any attempt to destroy the queue while another thread is waiting on its state change will be properly serialized and prevented from proceeding until the wait operation completes safely. This approach eliminates the race window by enforcing strict ordering between destruction and access operations without relying solely on lock retention during potentially long-blocking waits. The fix aligns with best practices for concurrent programming in kernel space, emphasizing explicit state tracking to manage resource lifecycles under contention.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques if exploited via local privilege escalation following the crash or memory corruption event. It also relates to CWE-362 regarding concurrent execution using shared resources with insufficient synchronization. System administrators should ensure that kernel updates incorporating this patch are applied promptly to maintain system integrity. Regular auditing of driver logs for unexpected GPU resets can serve as an indicator of whether such race conditions were previously triggered in production environments before the fix was deployed.