CVE-2026-80703

A flaw was found in the Linux kernel's drm/amdkfd component. A local user with access to /dev/kfd could exploit a missing authorization check to terminate another process's active Graphics Processing Unit (GPU) debug session. This could lead to a denial of service for other users attempting to debug GPU applications.

A moderate-impact flaw was found in the Linux kernel's AMDKFD (drm/amdkfd) GPU driver as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The KFD_IOC_DBG_TRAP_DISABLE ioctl was missing an authorization check, allowing a local user with access to /dev/kfd to terminate another process's active GPU debug session without being the owner of that session or an authorized ptrace-attached debugger. The consequence is a local denial of service limited to GPU debugging sessions; the issue does not provide privilege escalation, information disclosure, or memory corruption. This is reflected in the Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected, with the fix currently deferred on those streams; the residual risk is limited to unauthorized termination of GPU debug sessions by local users who already have /dev/kfd access. Red Hat Enterprise Linux 6 is out of support scope (OOSS) and no fix is planned for that stream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.