CVE-2026-98520

A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent GPU reset occurs, accessing this freed reference triggers a use-after-free condition and deadlock. A local user can exploit this vulnerability to cause a system hang, resulting in a Denial of Service (DoS).

This vulnerability is evaluated as Moderate severity because it requires local system access, relies on specific hardware configurations, and only impacts system availability. In typical Red Hat Enterprise Linux deployments, the issue can only be triggered on systems equipped with AMD GPU devices where multiple container instances share access to the GPU interface. A kernel deadlock occurs only if a device recovery cycle runs following the exit of an active container session. Without access to AMD GPU resources or virtualization features, standard workloads remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.