CVE-2026-80703
Description
A flaw was found in the Linux kernel's drm/amdkfd component. A local user with access to /dev/kfd could exploit a missing authorization check to terminate another process's active Graphics Processing Unit (GPU) debug session. This could lead to a denial of service for other users attempting to debug GPU applications.
Statement
A moderate-impact flaw was found in the Linux kernel's AMDKFD (drm/amdkfd) GPU driver as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The KFD_IOC_DBG_TRAP_DISABLE ioctl was missing an authorization check, allowing a local user with access to /dev/kfd to terminate another process's active GPU debug session without being the owner of that session or an authorized ptrace-attached debugger. The consequence is a local denial of service limited to GPU debugging sessions; the issue does not provide privilege escalation, information disclosure, or memory corruption. This is reflected in the Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected, with the fix currently deferred on those streams; the residual risk is limited to unauthorized termination of GPU debug sessions by local users who already have /dev/kfd access. Red Hat Enterprise Linux 6 is out of support scope (OOSS) and no fix is planned for that stream.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
