Loading story…
Canonical warned that Ubuntu kernel package 7.0.0-28.28 introduces a major AMDGPU performance regression for compute-heavy workloads using AMD ROCm on Ubuntu 26.04 and Ubuntu 24.04 LTS HWE systems. Reported impact reaches up to 42x slower throughput, with one cited example showing Stable Diffusion XL inference in ComfyUI stretching from 388 seconds to 42 minutes. Similar symptoms were previously reported by users on Fedora and in ComfyUI bug reports tied to Linux 7.0.12-era behavior.
Ubuntu said it will still ship the kernel because the release also carries important security fixes, but advised affected ROCm users to avoid or roll back from 7.0.0-28.28 until a corrected package is available. The issue has been fixed upstream in Linux 7.0.13, and a later Ubuntu kernel update is expected to include that correction. As a temporary mitigation for some ComfyUI users, the following option was cited:
--disable-mmap
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Canonical advised AMD ROCm users to avoid Ubuntu kernel 7.0.0-28.28, and users already affected were told to revert to an earlier kernel until a fixed update becomes available. A temporary workaround noted for ComfyUI users was to use the "--disable-mmap" option.
Canonical acknowledged that Ubuntu kernel package 7.0.0-28.28 for Ubuntu 26.04 and Ubuntu 24.04 LTS HWE introduces a severe AMDGPU performance regression affecting ROCm compute workloads, with reported slowdowns of up to 42x. Ubuntu said it would still proceed with the release because the kernel also contains important security fixes.
Upstream maintainers fixed the AMDGPU/ROCm performance regression in Linux 7.0.13. This established that a corrected kernel existed even as downstream distributions were still dealing with affected builds.
The regression was observed by users on Fedora 44 and in ComfyUI-related bug reports, with compute-heavy AMD ROCm workloads suffering major slowdowns. One cited example involved Stable Diffusion XL inference via ComfyUI becoming dramatically slower.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
discourse.ubuntu.com
Open sourcephoronix.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52817** is a moderate-severity flaw in the Linux kernel's AMDGPU DRM driver. On affected GPUs, including VEGA20, a low-privileged local user can read the `amdgpu_regs_smc` debugfs file while the `smc_rreg` pointer is NULL, triggering a NULL-pointer dereference in `amdgpu_debugfs_regs_smc_read` and causing a kernel oops or system crash. Red Hat rates the local denial-of-service issue CVSS 3.1 5.5. The vulnerability is fixed in Linux stable releases 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later. Red Hat issued standard-kernel fixes for RHEL 8 and RHEL 9, plus the RHEL 8 real-time kernel, through advisories including RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:9315; RHEL 9 `kernel-rt` was listed as affected. Administrators should deploy the latest vendor-supported kernel update rather than backporting individual patches.
Aug 26, 2026
**CVE-2024-41093** is a null-pointer dereference in the Linux kernel's AMDGPU DRM virtual KMS code. A local low-privileged user could trigger a kernel crash and denial of service because the driver accessed `state->fb->obj[0]` without confirming that the framebuffer object existed. The issue is rated Moderate by Red Hat, with a CVSS v3.1 score of 5.5 and high availability impact. The upstream fix replaces the direct object access with `drm_gem_fb_get_obj()` and returns an error when no framebuffer object is present. Corrected upstream kernels include 5.15.162, 6.1.97, 6.6.37, 6.9.8, and 6.10; Red Hat has released updated RHEL 8 and RHEL 9 `kernel` and `kernel-rt` packages, while RHEL 6 and 7 are not affected. Organizations using AMDGPU should deploy the relevant kernel updates and reboot affected hosts.
Aug 26, 2026
Red Hat released **Important** Linux kernel updates for **RHEL 9** under `RHSA-2026:57252`, addressing **26 CVEs** across subsystems including **netfilter, DRM/AMD GPU drivers, SMB client, iSCSI target, memfd, UDF, SMC, and POSIX CPU timers**. The advisory highlights memory-safety issues such as buffer overflows, out-of-bounds reads and writes, use-after-free, double-free, and validation flaws, and requires affected systems to be **rebooted after patching**. Downstream distributions and vendors including **Oracle Linux, Rocky Linux, AlmaLinux, and Unity Linux** published corresponding kernel notices and scanner coverage, with several notices indicating **local exploitation** risk and, in some cases, that **exploits are available**. Two AMD-related kernel flaws illustrate the update set: **`CVE-2026-45878`** in `drm/amdkfd` fixed inconsistent signed/unsigned handling of a userspace-supplied `watch_id`, which could trigger invalid bit shifts, out-of-bounds access to the `watch_points` array, and a buffer overflow; and **`CVE-2026-53329`** in `drm/amd/display` replaced `krealloc()` with `krealloc_array()` to prevent integer-overflow-driven undersized allocations that could lead to heap overflows during vector growth. The weaknesses align with well-known classes such as **`CWE-131`** (incorrect calculation of buffer size), **`CWE-120`** (classic buffer overflow), and in some bundled advisories **`CWE-279`** (incorrect execution-assigned permissions), underscoring the need to prioritize kernel package updates across supported enterprise Linux fleets.
Aug 28, 2026