CVE-2026-97928

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97928", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.203Z", "datePublished": "2026-09-25T10:22:45.430Z", "dateUpdated": "2026-10-21T12:53:39.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:39.969Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: skip the VMID 0 flush for VRAM\n\nClear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches\nvia its direct MC address without programming a GART window, yet the wipe\nstill forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA\nflush can wedge the engine; only flush when a GART window is actually used.\n\nv2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,\n and drive the clear and copy paths from that. (Christian)\nv3: Make the vm_needs_flush output parameter mandatory instead of\n allowing NULL. (Christian)\n\n(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"], "versions": [{"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "lessThan": "6593494733ccaf691db7bd13801583d188409607", "status": "affected", "versionType": "git"}, {"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "lessThan": "30dacb56f07283a1acb353ce81baef31f85396b0", "status": "affected", "versionType": "git"}, {"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "lessThan": "241d7450cf75969cea450eb3e740cb9682f69c2f", "status": "affected", "versionType": "git"}, {"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "lessThan": "87ceb8cba73d0b3c4025ff42495bccd8164acaed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6593494733ccaf691db7bd13801583d188409607"}, {"url": "https://git.kernel.org/stable/c/30dacb56f07283a1acb353ce81baef31f85396b0"}, {"url": "https://git.kernel.org/stable/c/241d7450cf75969cea450eb3e740cb9682f69c2f"}, {"url": "https://git.kernel.org/stable/c/87ceb8cba73d0b3c4025ff42495bccd8164acaed"}], "title": "drm/amdgpu: skip the VMID 0 flush for VRAM", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6593494733ccaf691db7bd13801583d188409607", "status": "affected", "version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "versionType": "git"}, {"lessThan": "30dacb56f07283a1acb353ce81baef31f85396b0", "status": "affected", "version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "versionType": "git"}, {"lessThan": "241d7450cf75969cea450eb3e740cb9682f69c2f", "status": "affected", "version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "versionType": "git"}, {"lessThan": "87ceb8cba73d0b3c4025ff42495bccd8164acaed", "status": "affected", "version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: skip the VMID 0 flush for VRAM\n\nClear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches\nvia its direct MC address without programming a GART window, yet the wipe\nstill forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA\nflush can wedge the engine; only flush when a GART window is actually used.\n\nv2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,\n and drive the clear and copy paths from that. (Christian)\nv3: Make the vm_needs_flush output parameter mandatory instead of\n allowing NULL. (Christian)\n\n(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)"}], "id": "CVE-2026-97928", "lastModified": "2026-10-21T13:21:16.320", "metrics": {}, "published": "2026-09-25T11:17:20.063", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/241d7450cf75969cea450eb3e740cb9682f69c2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/30dacb56f07283a1acb353ce81baef31f85396b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6593494733ccaf691db7bd13801583d188409607"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87ceb8cba73d0b3c4025ff42495bccd8164acaed"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: skip the VMID 0 flush for VRAM", "id": "2541240", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541240"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-440", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: skip the VMID 0 flush for VRAM\nClear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches\nvia its direct MC address without programming a GART window, yet the wipe\nstill forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA\nflush can wedge the engine; only flush when a GART window is actually used.\nv2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,\nand drive the clear and copy paths from that. (Christian)\nv3: Make the vm_needs_flush output parameter mandatory instead of\nallowing NULL. (Christian)\n(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)", "A flaw was found in the AMD GPU (amdgpu) driver within the Linux kernel. When clearing video memory (VRAM) upon deallocation, the driver performs an unnecessary virtual memory flush operation. A local user can trigger this flaw during graphics memory operations, causing the graphics processing unit (GPU) engine to hang and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97928", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97928\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97928\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97928.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a68c7eaa7a8ffdec9287ba1561a668d674c20a13,241d7450cf75969cea450eb3e740cb9682f69c2f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a68c7eaa7a8ffdec9287ba1561a668d674c20a13,87ceb8cba73d0b3c4025ff42495bccd8164acaed)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T20:45:17.062012+00:00", "updated": "2026-10-01T08:45:03.649232+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}