CVE-2026-97946

A flaw was found in the Linux kernel. Improper reference counting during AMD PCI root device initialization and caching in the amd_smn_init() function fails to properly track device lifecycles. Under certain conditions, this flaw may allow a local attacker to cause a Denial of Service (DoS) or system instability due to premature resource deallocation or memory leaks.

A flaw of MODERATE impact was found in the Linux kernel x86 AMD node subsystem, affecting the kernel in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10), Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform 4.12+ streams built on RHEL 9 CoreOS (openshift-4.22, openshift-4.23, openshift-5.0, openshift-5.1). In amd_smn_init(), the temporary PCI root device pointer obtained from the pci_get_class() search iterator was cached in amd_roots without taking an independent reference count, and the temporary search reference was not correctly cleaned up after the search. If the underlying PCI device is later removed, the cached pointer can become stale and be dereferenced by subsequent AMD SMN handling, resulting in a use-after-free that can crash the kernel or cause system instability and a local denial of service. The issue is local (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and does not impact confidentiality or integrity. Earlier Red Hat Enterprise Linux 6, 7, 8, 9, and 10 update streams, the kernel-rt builds, and earlier OpenShift Container Platform CoreOS streams were assessed as not affected because the vulnerable code is not present in those kernels. The fix for the affected streams is currently deferred; the residual risk is limited to a local attacker causing a kernel crash or denial of service on affected AMD-based systems, with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.