CVE-2026-98520Medium· 4.7▾ SunlitA flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 7.8
none → high
7.8 → 4.7
high → medium
A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent GPU reset occurs, accessing this freed reference triggers a use-after-free condition and deadlock. A local user can exploit this vulnerability to cause a system hang, resulting in a Denial of Service (DoS).
kernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-24.
Affected:
No fix planned:
Not affected:
Out of support scope
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98773Medium· 4.7kernel: USB: cdc-acm: skip URB restart in port_shutdown if disconnected (CVE-2026-98773)
CVE-2026-98866Medium· 4.7kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF (CVE-2026-98866)
CVE-2026-98870Medium· 6.5kernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
CVE-2026-110753Critical· 9.8Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
CVE-2025-68359Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree() scenario when calling…
CVE-2026-109729Medium· 5.4Use-after-free in the JavaScript Engine: JIT component