CVE-2026-98520

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping

kfd_dev_mapping caches the address_space of the first /dev/kfd opener

so that the GPU reset path can call unmap_mapping_range() to zap all

userspace mappings of doorbell and MMIO ranges. This design has two

bugs that both manifest under SRIOV with multiple containers:

1. Use-after-free / rwsem deadlock. The cached pointer refers to an

inode owned by the first opener's container. When that container

exits and its inode is released, kfd_dev_mapping becomes a dangling

pointer. A subsequent GPU reset dereferences it inside

unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode,

causing a hard hang observable as an uninterruptible rwsem wait.

2. Multi-container gap. Only the first opener's address_space is cached;

VMAs created by later openers live in a different address_space and

are never reached by unmap_ma

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References