Linux Kernel CVE-2026-97496

Requires local access to the AMD KFD device node (/dev/kfd) on a system with an AMD GPU using the GFXv9-class compute stack, plus the ability to invoke the AMDKFD_IOC_RESTORE_PROCESS ioctl (CRIU restore, H3) to supply a malicious MQD with attacker-controlled cp_hqd_cntl_stack_size/cp_hqd_cntl_stack_offset. Exploitation is limited to unprivileged-but-local attackers (PR:L, AV:L) - there is no remote or network vector - and only affects unpatched kernels prior to 6.12.111 / 6.18.53 / 7.2 running AMD KFD; systems without an AMD GPU/KFD driver are not exposed.

This is a local, low-privilege kernel information-disclosure with a real technical basis, not merely a high-CVSS paper cut. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 7.1) is internally consistent with the description: an attacker with access to the AMD KFD device node feeds attacker-controlled cp_hqd_cntl_stack_size/offset values through the CRIU-restore path, causing an integer underflow that produces a ~4 GiB copy_to_user() length and leaks adjacent GTT/kernel memory (other queues' MQDs, ring buffers, KASLR pointers). C:H is genuinely justified here - unlike many sibling amdkfd/ACPICA CVEs in this batch that are crash-dominant and mislabeled, this one is a legitimate confidentiality leak, and A:H is defensible because an unbounded read can also fault/crash. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation probability signals are absent rather than negative. The practical risk is bounded by the local-access and AMD-GPU-plus-KFD prerequisites: this is a useful KASLR-defeat / info-leak primitive in a local privilege-escalation chain, not a remotely mass-exploitable flaw. CWE is listed as N/A but the true weakness is CWE-125/CWE-190 (OOB read via integer underflow).

A local unprivileged user with access to the AMD KFD render/compute device invokes AMDKFD_IOC_RESTORE_PROCESS (the CRIU restore path) supplying a crafted MQD whose cp_hqd_cntl_stack_size/offset fields are attacker-chosen. When get_wave_state() later trusts these microcode-written values, an integer underflow yields a multi-gigabyte copy_to_user() that returns adjacent kernel/GTT memory - including other queues' MQDs, ring buffers, and KASLR pointers - defeating address-space randomization for a follow-on exploit. No public exploit was identified at time of analysis.