{"id":"CVE-2026-98910","kind":"vulnerability","aliases":["CVE-2026-98910"],"related":[],"title":"Linux kernel AMD GPU debug trap leaves inconsistent state on copy failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Unwind debug trap enable on copy_to_user failure\n\nIf kfd_dbg_trap_enable() fails while copying runtime_info to userspace,\nit had already activated the trap, set debug_trap_enabled, taken an extra\nprocess reference, and opened the debug event file. Return -EFAULT without\nunwinding that state, leaving inconsistent trap state and a refcount\nimbalance that could break later DISABLE/ENABLE.\n\nOn copy_to_user failure, deactivate the trap and undo the rest of the\nenable setup before returning.","summary":"When enabling the AMD KFD debug trap fails while copying runtime info to userspace, the kernel returns an error without undoing the trap setup, leaving a refcount imbalance and inconsistent trap state. The sources do not say that an attacker can gain code execution or read data from this flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-gpu","linux-kernel","rocm","runtime"],"not_affected_if":["no-amd-gpu"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for drm/amdkfd debug trap enable unwinding (version unknown from the sources).","status":"open","published_at":"2026-10-23T12:18:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:30+00:00","updated_at":"2026-10-25T04:58:30+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:58:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for drm/amdkfd debug trap enable unwinding (version unknown from the sources).","reach":"local","title":"Linux kernel AMD GPU debug trap leaves inconsistent state on copy failure","impact":"low","summary":"When enabling the AMD KFD debug trap fails while copying runtime info to userspace, the kernel returns an error without undoing the trap setup, leaving a refcount imbalance and inconsistent trap state. The sources do not say that an attacker can gain code execution or read data from this flaw.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","amd-gpu","rocm"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources describe state corruption and refcount imbalance only","analyst_note":"Check the upstream kernel commit and NVD entry CVE-2026-98910 for affected versions, the fixed commit, and whether the refcount imbalance is exploitable.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-amd-gpu"],"who_is_affected":"Systems running a Linux kernel with the amdkfd driver for AMD GPUs, which is used for compute and ROCm workloads. Hosts without AMD GPUs or without the KFD driver loaded are unlikely to be exposed. The sources do not say which kernel versions are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000614,"input_tokens":3426,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98910':15A,18A 'activ':112C 'alreadi':111C 'amd':3A,20B,30B 'amd-gpu':19B 'attack':66B 'break':146C 'code':69B 'copi':11A,36B,93C,104C,150C 'could':145C 'cve':13A,16A 'data':73B 'dbg':99C 'deactiv':154C 'debug':5A,32B,89C,116C,127C 'disable/enable':148C 'drm/amdkfd':87C 'efault':131C 'enabl':28B,91C,101C,118C,163C 'error':45B 'event':128C 'execut':70B 'extra':121C 'fail':34B,102C 'failur':12A,96C,153C 'file':129C 'flaw':76B 'follow':82C 'gain':68B 'gpu':4A,21B 'imbal':54B,143C 'inconsist':8A,56B,137C 'info':38B,106C 'kernel':2A,24B,42B,80C 'kfd':31B,98C 'later':147C 'leav':7A,51B,136C 'linux':1A,23B,79C 'linux-kernel':22B 'open':125C 'process':122C 'read':72B 'refcount':53B,142C 'refer':123C 'resolv':86C 'rest':160C 'return':43B,130C,166C 'rocm':25B 'runtim':26B,37B,105C 'say':63B 'set':115C 'setup':50B,164C 'sourc':60B 'state':9A,58B,135C,139C 'taken':119C 'trap':6A,33B,49B,57B,90C,100C,114C,117C,138C,156C 'undo':47B,158C 'unwind':88C,133C 'user':95C,152C 'userspac':40B,108C 'vulner':83C 'without':46B,132C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the amdkfd driver for AMD GPUs, which is used for compute and ROCm workloads. Hosts without AMD GPUs or without the KFD driver loaded are unlikely to be exposed. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98910","severity":null,"published_at":"2026-10-23T12:18:25+00:00","modified_at":"2026-10-23T12:18:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}