CVE-2026-98910 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Unwind debug trap enable on copy_to_user failure
If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE.
On copy_to_user failure, deactivate the trap and undo the rest of the enable setup before returning.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's DRM AMD KFD subsystem represents a critical resource management flaw arising from improper error handling during user-space data transfer operations. Specifically, within the kfd_dbg_trap_enable function, the code sequence performs several state-altering actions such as activating hardware debug traps, setting internal flags to indicate that debugging is enabled, incrementing process reference counts, and opening event files for communication with userspace applications. These steps are necessary to establish a functional debugging context but introduce significant complexity in maintaining consistency between kernel-internal state and the actual operational status of the device driver. The core issue manifests when the subsequent attempt to copy runtime information to user space fails due to an invalid memory address or otherEFAULT condition. In this scenario, the function returns an error code immediately without reversing the previously executed setup steps. This lack of cleanup logic leaves the system in a partially initialized state where the trap is active and resources are held, but the operation is reported as failed from the perspective of the caller.
This inconsistent state has severe operational implications for subsequent interactions with the AMD GPU driver. Because the debug trap remains enabled despite the failure to provide information to userspace, any future attempts to disable or re-enable debugging features may encounter logical contradictions within the driver's internal logic. The reference count imbalance is particularly dangerous as it prevents proper resource release when processes terminate or detach from the device. Over time, this can lead to memory leaks and file descriptor exhaustion, effectively causing a denial of service condition for other users on the system who rely on GPU resources. Furthermore, the mismatch between the enabled trap state and the perceived disabled status in user-space tools can cause crashes or undefined behavior when debugging sessions are attempted later, as the kernel expects certain conditions that no longer align with reality due to the incomplete initialization sequence.
From a classification standpoint, this vulnerability is best described under CWE-401 which refers to missing release of memory after successful allocation, although in this context it extends beyond simple memory leaks to include improper state management and resource handle leakage. The flaw also aligns with CWE-252 concerning unchecked return values, as the code fails to verify that all prerequisite steps were completed successfully before proceeding or failing gracefully. In terms of attack vectors, an attacker could potentially exploit this by repeatedly triggering copy_to_user failures through malformed pointers in debugging requests. This would allow for a gradual degradation of system stability via resource exhaustion without requiring elevated privileges if the user has access to AMD GPU devices and their associated debug interfaces. The ATT&CK framework categorizes such behavior under Resource Hijacking, specifically within techniques that involve consuming limited resources like file descriptors or kernel memory structures to disrupt service availability.
Mitigation strategies for this vulnerability primarily rely on applying vendor-provided patches that correct the error handling path in the kfd_dbg_trap_enable function. Developers must ensure that any state changes made prior to a potential failure point are rolled back if subsequent steps fail. This involves implementing proper unwind logic where, upon detecting anEFAULT or other copy failures, the driver deactivates the debug trap, decrements the process reference count, closes the opened event file, and resets the internal flags to reflect that debugging is not enabled. System administrators should prioritize updating their kernel versions to include these fixes, particularly on systems running AMD GPUs with active KFD support for heterogeneous computing tasks. Additionally, implementing strict validation of user-space pointers before initiating complex multi-step operations can reduce the likelihood of encountering such errors in production environments, thereby minimizing exposure to this class of state inconsistency vulnerabilities.