CVE-2026-97424

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97424", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T14:53:16.868Z", "datePublished": "2026-09-24T16:03:37.028Z", "dateUpdated": "2026-10-21T12:52:45.222Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:52:45.222Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq\n\ncp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but\nreleased in gfx_v9_0_hw_fini(), so the put site has to query\namdgpu_irq_enabled() because the get is skipped on SR-IOV VF.\n\nras_late_init / ras_fini have no suspend counterpart, so move the\nput to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a\nmatching ras_suspend callback that is invoked from\namdgpu_ras_suspend() before disable_all_features(). The get and\nput now sit in the same place and check the same condition (not\nVF, funcs registered), no refcount querying needed.\n\nAn active flag gates ras_fini so the\nsuspend-then-unload-without-resume path falls into\namdgpu_ras_block_late_fini_default() instead of double-releasing\nwhat ras_suspend already cleaned up.\n\nDrop the cp_ecc_error_irq put from gfx_v9_0_hw_fini(). gfx_v8_0\nmanages cp_ecc_error_irq locally and is unaffected; no other GFX\ngeneration has this IRQ."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h", "drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"], "versions": [{"version": "760a1d55344d823287850466db893ed77e948803", "lessThan": "c1f2f34d681a0b354e1218b83245d1f2d2139a8d", "status": "affected", "versionType": "git"}, {"version": "760a1d55344d823287850466db893ed77e948803", "lessThan": "5b761927dbb170df4716d9c0ef85e178a1856e64", "status": "affected", "versionType": "git"}, {"version": "760a1d55344d823287850466db893ed77e948803", "lessThan": "001824103f2fe6ffd2380afddf81f43b446035b2", "status": "affected", "versionType": "git"}, {"version": "760a1d55344d823287850466db893ed77e948803", "lessThan": "e3829992dd9fa0a82511af4f01733fc854cd15a5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h", "drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c1f2f34d681a0b354e1218b83245d1f2d2139a8d"}, {"url": "https://git.kernel.org/stable/c/5b761927dbb170df4716d9c0ef85e178a1856e64"}, {"url": "https://git.kernel.org/stable/c/001824103f2fe6ffd2380afddf81f43b446035b2"}, {"url": "https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}], "title": "drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h", "drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c1f2f34d681a0b354e1218b83245d1f2d2139a8d", "status": "affected", "version": "760a1d55344d823287850466db893ed77e948803", "versionType": "git"}, {"lessThan": "5b761927dbb170df4716d9c0ef85e178a1856e64", "status": "affected", "version": "760a1d55344d823287850466db893ed77e948803", "versionType": "git"}, {"lessThan": "001824103f2fe6ffd2380afddf81f43b446035b2", "status": "affected", "version": "760a1d55344d823287850466db893ed77e948803", "versionType": "git"}, {"lessThan": "e3829992dd9fa0a82511af4f01733fc854cd15a5", "status": "affected", "version": "760a1d55344d823287850466db893ed77e948803", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h", "drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq\n\ncp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but\nreleased in gfx_v9_0_hw_fini(), so the put site has to query\namdgpu_irq_enabled() because the get is skipped on SR-IOV VF.\n\nras_late_init / ras_fini have no suspend counterpart, so move the\nput to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a\nmatching ras_suspend callback that is invoked from\namdgpu_ras_suspend() before disable_all_features(). The get and\nput now sit in the same place and check the same condition (not\nVF, funcs registered), no refcount querying needed.\n\nAn active flag gates ras_fini so the\nsuspend-then-unload-without-resume path falls into\namdgpu_ras_block_late_fini_default() instead of double-releasing\nwhat ras_suspend already cleaned up.\n\nDrop the cp_ecc_error_irq put from gfx_v9_0_hw_fini(). gfx_v8_0\nmanages cp_ecc_error_irq locally and is unaffected; no other GFX\ngeneration has this IRQ."}], "id": "CVE-2026-97424", "lastModified": "2026-10-21T13:21:09.637", "metrics": {}, "published": "2026-09-24T17:17:20.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/001824103f2fe6ffd2380afddf81f43b446035b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b761927dbb170df4716d9c0ef85e178a1856e64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c1f2f34d681a0b354e1218b83245d1f2d2139a8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq", "id": "2540446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540446"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq\ncp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but\nreleased in gfx_v9_0_hw_fini(), so the put site has to query\namdgpu_irq_enabled() because the get is skipped on SR-IOV VF.\nras_late_init / ras_fini have no suspend counterpart, so move the\nput to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a\nmatching ras_suspend callback that is invoked from\namdgpu_ras_suspend() before disable_all_features(). The get and\nput now sit in the same place and check the same condition (not\nVF, funcs registered), no refcount querying needed.\nAn active flag gates ras_fini so the\nsuspend-then-unload-without-resume path falls into\namdgpu_ras_block_late_fini_default() instead of double-releasing\nwhat ras_suspend already cleaned up.\nDrop the cp_ecc_error_irq put from gfx_v9_0_hw_fini(). gfx_v8_0\nmanages cp_ecc_error_irq locally and is unaffected; no other GFX\ngeneration has this IRQ.", "A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. A local user could cause a Denial of Service (DoS) by triggering a system suspend followed by unloading the driver. Due to missing suspend handling and improper cleanup logic in the Reliability, Availability, and Serviceability (RAS) subsystem, the driver can attempt to release interrupt resources twice. This double-release condition can destabilize the operating system and lead to a kernel crash."], "name": "CVE-2026-97424", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97424\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97424\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97424.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,001824103f2fe6ffd2380afddf81f43b446035b2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e3829992dd9fa0a82511af4f01733fc854cd15a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T22:45:18.537937+00:00", "updated": "2026-10-01T18:45:06.989118+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}