CVE-2026-97498 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction
mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly.
During eviction if these buffers are evicted the hw continue to use the invalid addresses and caused page faults and system hung.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel driver for AMD GPU hardware, specifically within the amdgpu subsystem responsible for managing user-mode queues, contained a critical memory management flaw related to buffer object handling. The vulnerability centers on the lifecycle management of Memory Queue Descriptor (MQD) objects and firmware-related buffer objects. These specific data structures are fundamental components that define how the graphics processing unit interprets command streams and executes workloads submitted by user-space applications. Under normal operating conditions, these buffers must remain resident in physical memory to ensure consistent access patterns from both the CPU driver stack and the GPU hardware engine. The identified defect arose because the kernel did not explicitly pin these critical buffer objects during their active usage period within a queue context.
In Linux graphics drivers, buffer eviction is a standard mechanism used by the TTM (Translation Table Maps) memory manager to reclaim physical RAM when system resources are constrained or under heavy load. When the driver attempts to evict buffers from VRAM to system RAM or swap space, it typically unmaps them from the GPU's address space and updates page tables accordingly. However, in this specific scenario involving user-mode queues, the eviction logic failed to recognize that MQD and firmware objects are persistent state structures required for continuous hardware operation. Consequently, when memory pressure triggered an eviction cycle, these essential buffers were unmapped and potentially moved or invalidated while still actively referenced by the GPU's queue processing engines.
The operational impact of this flaw is severe and directly affects system stability. When the GPU hardware continues to execute commands that reference the now-invalidated physical addresses of the evicted MQD or firmware objects, it results in a page fault at the hardware level. Unlike software-level exceptions which can be caught and handled gracefully by the operating system kernel, hardware page faults on critical control structures often lead to an unrecoverable state for the graphics engine. This manifests as immediate system hangs, frozen displays, or complete kernel panics requiring a hard reset. The issue highlights a failure in resource reservation logic where transient memory management policies were incorrectly applied to persistent hardware configuration data.
From a vulnerability classification perspective, this flaw aligns with CWE-401, which describes the missing release of a non-reentrant lock or resource after it is used, although more accurately it reflects CWE-787: Out-of-bounds Write due to improper pointer arithmetic or management leading to invalid memory access. In terms of adversarial tactics and defensive mapping, this issue relates to ATT&CK technique T1499, Endpoint Denial of Service, as the primary consequence is a denial of service through system instability rather than unauthorized data exfiltration or privilege escalation. The root cause lies in the driver's failure to maintain reference counts or pinning states for hardware-critical buffers during active queue execution windows.
To mitigate this vulnerability and prevent similar issues in future kernel versions, developers must ensure that buffer objects designated as MQDs and firmware contexts are explicitly pinned in memory for the duration of their association with a user queue. This involves modifying the amdgpu driver's eviction logic to check if any active queues reference specific buffers before allowing them to be evicted or unmapped. Additionally implementing robust error handling paths that can gracefully reset the GPU hardware state upon detecting such invalid address accesses would improve resilience, although prevention through proper memory pinning remains the primary and most effective defense strategy against this class of kernel-level stability issues.