Linux Kernel EUVD-2026-32845

Vendor-released patch: upgrade to Linux kernel 6.6.140, 6.12.90, 6.18.32, 7.0.9, or 7.1-rc1 (or later) depending on which stable branch you track; the upstream stable commits are available at https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53f and the four sibling commits listed in references. Distribution users should apply the next kernel update from their vendor (RHEL, Ubuntu, SUSE, Debian) once it ships these stable backports. As a compensating control until patching, restrict access to GPU device nodes by removing untrusted users from the 'video' and 'render' groups and tightening permissions on /dev/dri/renderD* and /dev/dri/card*, accepting the trade-off that affected users lose hardware-accelerated video decode/encode and GPU compute access; on systems that do not require AMD GPU acceleration, blacklisting the amdgpu module entirely eliminates exposure but disables the GPU. Containerized environments should ensure GPU device passthrough is not exposed to untrusted workloads.