CVE-2026-97424

A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. A local user could cause a Denial of Service (DoS) by triggering a system suspend followed by unloading the driver. Due to missing suspend handling and improper cleanup logic in the Reliability, Availability, and Serviceability (RAS) subsystem, the driver can attempt to release interrupt resources twice. This double-release condition can destabilize the operating system and lead to a kernel crash.

A flaw of low impact was found in the Linux kernel's AMD GPU (amdgpu) driver as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL 9 CoreOS. The issue is in the Reliability, Availability, and Serviceability (RAS) handling of the cp_ecc_error_irq interrupt: the interrupt is acquired during RAS late initialization but released from a separate hardware shutdown path, and the RAS teardown has no suspend counterpart. As a result, a local user able to trigger a system suspend followed by unloading the amdgpu driver without an intervening resume can cause the same interrupt resources to be released twice. This double-release can destabilize the system and lead to a kernel crash (denial of service). There is no impact on confidentiality or integrity.

Red Hat Enterprise Linux 7 and 8, including their realtime kernels, and OpenShift Container Platform 4.12 built on RHEL 8 CoreOS are not affected because the vulnerable code is not present in those releases.

Fixes for the affected products are currently deferred because the security risk is low: triggering the flaw requires local access with the ability to trigger a system suspend and unload the amdgpu driver, and the consequence is limited to loss of system availability. The residual risk on systems with affected AMD GPUs is a kernel crash or loss of GPU availability when the suspend-then-unload sequence occurs. Although the CVSS 3.1 base score is 5.5 (Moderate), the overall Red Hat severity is Low due to the local privileged access required and the availability-only impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.