CVE-2026-97498

A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. Memory queue and firmware buffer objects used by user queues were not pinned in memory, allowing them to be evicted during memory pressure. A local user could exploit this issue to cause the graphics hardware to access invalid memory addresses, resulting in page faults and a Denial of Service (DoS) via a system hang.

A moderate-impact denial of service flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. Memory queue descriptor (MQD) and firmware buffer objects used by user queues were not pinned in memory, so under memory pressure they could be evicted while the graphics hardware continued to reference their old addresses. A local user with access to an AMD GPU could trigger this eviction to make the hardware access invalid memory addresses, resulting in page faults and a system hang (denial of service). Red Hat rates this flaw as moderate impact (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable amdgpu user-queue code is not present in the kernels shipped with Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, or OpenShift Container Platform, so those products are not affected; the only Red Hat stream recorded with the affected component is RHEL 6 ELS, which is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.