{"cve":"CVE-2026-97422","nvd":{"published":"2026-09-24T17:17:20.113","modified":"2026-10-21T13:21:09.520","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix SMI event cross-process information leak\n\nkfd_smi_ev_enabled() skips the suser privilege check when pid=0.\nPROCESS_START, PROCESS_END, and VMFAULT events are emitted with\npid=0 while carrying another process's PID and command name, so any\n/dev/kfd user in the render group can monitor all GPU workloads.\n\nPass the target process PID into kfd_smi_event_add() for these events\nso the existing per-client filter restricts delivery to the owning\nprocess or CAP_SYS_ADMIN subscribers.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/470319a893f616ef661a63e825a8e1b9b6eddb91","https://git.kernel.org/stable/c/5bb2dfa65d8da83e87b2a31c270bc567df69a5ca","https://git.kernel.org/stable/c/6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a","https://git.kernel.org/stable/c/92a8dba246d371fe268280e5fd74b0955688e6df"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-97422","score":0.00168,"percentile":0.06158,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}