CVE-2026-98389
Description
A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. During recovery from a graphics processing unit (GPU) reset, background power management tasks can attempt to change power profiles before the reset completes. This improper synchronization causes hardware register access while reset locks are still held, triggering a kernel assertion failure. A local user could exploit this condition to crash the operating system, resulting in a Denial of Service (DoS).
Statement
A flaw with LOW security impact was found in the Linux kernel's AMD GPU (amdgpu) driver used by Red Hat products. During recovery from a GPU reset, the graphics idle work handler can invoke power profile switching before the reset has completed. This improper synchronization causes GPU register access while the GPU reset semaphore is still held, which triggers a kernel assertion failure. A local user with access to the affected AMD GPU device could exploit this narrow timing window to crash the system, resulting in a denial of service; there is no impact to confidentiality or integrity. The Red Hat Enterprise Linux 7, 8, 9, and 10 kernel and kernel-rt packages, the Red Hat In-Vehicle OS 2 kernels, and the OpenShift Container Platform RHEL CoreOS images are recorded as affected with a deferred fix. Because the issue is a local, timing-dependent denial of service with no confidentiality or integrity impact, the fix is deferred and will be delivered in a future kernel update; the residual risk is a possible system crash during GPU reset recovery on systems with affected AMD graphics hardware. The Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of active support scope for this issue.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
