---
id: "CVE-2026-98910"
kind: "vulnerability"
aliases: ["CVE-2026-98910"]
title: "Linux kernel AMD GPU debug trap leaves inconsistent state on copy failure"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["amd-gpu", "linux-kernel", "rocm", "runtime"]
not_affected_if: ["no-amd-gpu"]
published_at: "2026-10-23T12:18:25+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98910", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98910", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel AMD GPU debug trap leaves inconsistent state on copy failure

When enabling the AMD KFD debug trap fails while copying runtime info to userspace, the kernel returns an error without undoing the trap setup, leaving a refcount imbalance and inconsistent trap state. The sources do not say that an attacker can gain code execution or read data from this flaw.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream fix for drm/amdkfd debug trap enable unwinding (version unknown from the sources).

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98910
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98910

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Unwind debug trap enable on copy_to_user failure

If kfd_dbg_trap_enable() fails while copying runtime_info to userspace,
it had already activated the trap, set debug_trap_enabled, taken an extra
process reference, and opened the debug event file. Return -EFAULT without
unwinding that state, leaving inconsistent trap state and a refcount
imbalance that could break later DISABLE/ENABLE.

On copy_to_user failure, deactivate the trap and undo the rest of the
enable setup before returning.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_