CVE-2026-97900

A low impact flaw was found in the Linux kernel's Direct Rendering Manager (DRM) execution helper (drm_exec), which is shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform. When drm_exec_prepare_array() is called with an empty (zero-object) array while a previously contended lock is still pending, it returns success without resolving the contended object. Drivers that chain multiple drm_exec_prepare_array() calls within one drm_exec_until_all_locked() iteration, such as the amdgpu user-queue signal and wait ioctls, can therefore loop indefinitely without ever resolving the contention. A local user with access to a DRM device interface could use this flaw to cause a denial of service by triggering an infinite loop that hangs the kernel in the affected ioctl path; there is no impact to confidentiality or integrity.

Red Hat Enterprise Linux 6, 7, and 8, RHEL 9.2, and OpenShift Container Platform 4.12 through 4.15 are not affected because the vulnerable code is not present in those streams. The affected scope comprises RHEL 9 update streams 9.4 and later, RHEL 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform versions based on the RHEL 9 CoreOS kernel from 4.16 onward, including OpenShift 5. For these affected products the fix is deferred to a future update because of the low security impact of the flaw; the residual risk is a local denial of service, which requires an attacker to already have local access to DRM device interfaces. While the CVSS:3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) corresponds to Moderate severity, Red Hat rates the impact of this flaw as LOW because exploitation requires local access to DRM device interfaces and the consequence is limited to system availability.