CVE-2026-97424
Description
A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. A local user could cause a Denial of Service (DoS) by triggering a system suspend followed by unloading the driver. Due to missing suspend handling and improper cleanup logic in the Reliability, Availability, and Serviceability (RAS) subsystem, the driver can attempt to release interrupt resources twice. This double-release condition can destabilize the operating system and lead to a kernel crash.
Statement
A flaw of low impact was found in the Linux kernel's AMD GPU (amdgpu) driver as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL 9 CoreOS. The issue is in the Reliability, Availability, and Serviceability (RAS) handling of the cp_ecc_error_irq interrupt: the interrupt is acquired during RAS late initialization but released from a separate hardware shutdown path, and the RAS teardown has no suspend counterpart. As a result, a local user able to trigger a system suspend followed by unloading the amdgpu driver without an intervening resume can cause the same interrupt resources to be released twice. This double-release can destabilize the system and lead to a kernel crash (denial of service). There is no impact on confidentiality or integrity.
Red Hat Enterprise Linux 7 and 8, including their realtime kernels, and OpenShift Container Platform 4.12 built on RHEL 8 CoreOS are not affected because the vulnerable code is not present in those releases.
Fixes for the affected products are currently deferred because the security risk is low: triggering the flaw requires local access with the ability to trigger a system suspend and unload the amdgpu driver, and the consequence is limited to loss of system availability. The residual risk on systems with affected AMD GPUs is a kernel crash or loss of GPU availability when the suspend-then-unload sequence occurs. Although the CVSS 3.1 base score is 5.5 (Moderate), the overall Red Hat severity is Low due to the local privileged access required and the availability-only impact.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
