VulnerabilityPublished 24 Sep 2026Updated 21 Oct 2026

CVE-2026-97424: Linux kernel · drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e3829992dd9fa0a82511af4f01733fc854cd15a5 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 20:12 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e3829992dd9fa0a82511af4f01733fc854cd15a5, c1f2f34d681a0b354e1218b83245d1f2d2139a8d, 001824103f2fe6ffd2380afddf81f43b446035b2 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to e3829992dd9fa0a82511af4f01733fc854cd15a5, c1f2f34d681a0b354e1218b83245d1f2d2139a8d, 001824103f2fe6ffd2380afddf81f43b446035b2 or 5b761927dbb170df4716d9c0ef85e178a1856e64.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 760a1d55344d823287850466db893ed77e948803, < e3829992dd9fa0a82511af4f01733fc854cd15a5	Fixed in e3829992dd9fa0a82511af4f01733fc854cd15a5
LinuxLinux	Affected ≥ 760a1d55344d823287850466db893ed77e948803, < c1f2f34d681a0b354e1218b83245d1f2d2139a8d	Fixed in c1f2f34d681a0b354e1218b83245d1f2d2139a8d
LinuxLinux	Affected ≥ 760a1d55344d823287850466db893ed77e948803, < 001824103f2fe6ffd2380afddf81f43b446035b2	Fixed in 001824103f2fe6ffd2380afddf81f43b446035b2
LinuxLinux	Affected ≥ 760a1d55344d823287850466db893ed77e948803, < 5b761927dbb170df4716d9c0ef85e178a1856e64	Fixed in 5b761927dbb170df4716d9c0ef85e178a1856e64
LinuxLinux	Affected =5.2	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to the fixed kernel versions or apply the relevant patches to ensure proper handling of the cp_ecc_error_irq interrupt in the amdgpu driver. No additional mitigation actions are indicated.

Description

A vulnerability in the Linux kernel's amdgpu driver related to the handling of the cp_ecc_error_irq interrupt has been addressed by adding a ras_suspend callback and reorganizing the suspend and release logic. This fix ensures proper reference counting and prevents double release of resources during suspend and unload sequences.

Impact

The vulnerability could lead to improper handling of the cp_ecc_error_irq interrupt reference counting, potentially causing resource mismanagement or instability in the amdgpu driver during suspend and unload operations. However, no active exploits are known in the wild, and the issue is specific to certain hardware generations and kernel versions.

Summary

The Linux kernel's amdgpu driver had an issue where the cp_ecc_error_irq interrupt was acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(), causing potential reference counting inconsistencies, especially on SR-IOV virtual functions (VFs). The fix introduces a ras_suspend callback invoked from amdgpu_ras_suspend() before disabling all features, moving the get and put operations to the same context and checking the same conditions to avoid double releasing. This change also adds an active flag to gate ras_fini, ensuring the suspend-then-unload-without-resume path is handled correctly. The cp_ecc_error_irq put call was removed from gfx_v9_0_hw_fini(), and gfx_v8_0 remains unaffected as it manages the IRQ locally.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 20:12 UTC

Technical details

References

Community reviews

Related threats