CVE-2026-97422
kernel: drm/amdkfd: fix SMI event cross-process information leak
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 24, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel. The AMD Kernel Fusion Driver (amdkfd) subsystem fails to enforce proper permission checks when dispatching System Management Interface (SMI) event notifications. A local user with access to the GPU compute device can exploit this flaw to receive event notifications containing process identifiers and command names belonging to other processes. This issue results in cross-process information disclosure, allowing an attacker to monitor active GPU workloads on the system.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-201 · Insertion of Sensitive Information Into Sent Data