CVE-2026-97429 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix UAF race in destroy_queue_cpsch

wait_on_destroy_queue() drops locks to wait for queue resume, allowing
a concurrent destroy to free the queue. Use is_being_destroyed flag to
serialize destruction.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/41144829f4645c2bd4cb501d34d253858f750c0a
https://git.kernel.org/stable/c/ac081deaf16a639ea7dff2f285fe421a33c1ade0
https://git.kernel.org/stable/c/d98c8032c29944e1e572e1f49a0613d364fece0f

History

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy_queue_cpsch wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.
Title		drm/amdkfd: fix UAF race in destroy_queue_cpsch
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/41144829f4645c2bd4cb501d34d253858f750c0a https://git.kernel.org/stable/c/ac081deaf16a639ea7dff2f285fe421a33c1ade0 https://git.kernel.org/stable/c/d98c8032c29944e1e572e1f49a0613d364fece0f

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T16:03:42.269Z

Updated: 2026-09-24T16:03:42.269Z

Reserved: 2026-09-24T14:53:16.868Z

Link: CVE-2026-97429

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T17:17:20.907

Modified: 2026-09-24T17:17:20.907

Link: CVE-2026-97429

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97429", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T14:53:16.868Z", "datePublished": "2026-09-24T16:03:42.269Z", "dateUpdated": "2026-09-24T16:03:42.269Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-24T16:03:42.269Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix UAF race in destroy_queue_cpsch\n\nwait_on_destroy_queue() drops locks to wait for queue resume, allowing\na concurrent destroy to free the queue. Use is_being_destroyed flag to\nserialize destruction."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "41144829f4645c2bd4cb501d34d253858f750c0a", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d98c8032c29944e1e572e1f49a0613d364fece0f", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ac081deaf16a639ea7dff2f285fe421a33c1ade0", "status": "affected", "versionType": "git"}, {"version": "0", "lessThan": "6.12.111", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"], "versions": [{"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/41144829f4645c2bd4cb501d34d253858f750c0a"}, {"url": "https://git.kernel.org/stable/c/d98c8032c29944e1e572e1f49a0613d364fece0f"}, {"url": "https://git.kernel.org/stable/c/ac081deaf16a639ea7dff2f285fe421a33c1ade0"}], "title": "drm/amdkfd: fix UAF race in destroy_queue_cpsch", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "41144829f4645c2bd4cb501d34d253858f750c0a", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "d98c8032c29944e1e572e1f49a0613d364fece0f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "ac081deaf16a639ea7dff2f285fe421a33c1ade0", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "6.12.111", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.18.53", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix UAF race in destroy_queue_cpsch\n\nwait_on_destroy_queue() drops locks to wait for queue resume, allowing\na concurrent destroy to free the queue. Use is_being_destroyed flag to\nserialize destruction."}], "id": "CVE-2026-97429", "lastModified": "2026-09-24T17:17:20.907", "metrics": {}, "published": "2026-09-24T17:17:20.907", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41144829f4645c2bd4cb501d34d253858f750c0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ac081deaf16a639ea7dff2f285fe421a33c1ade0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d98c8032c29944e1e572e1f49a0613d364fece0f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}