CVE-2026-89807
UnknownSummary
In the Linux kernel, the drm/amdkfd driver lacked a NULL guard for restore_mqd during CRIU queue restore. A user with CAP_CHECKPOINT_RESTORE could trigger a kernel NULL pointer dereference and panic by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. The fix adds a NULL guard and returns -EOPNOTSUPP if the callback is not implemented.
Risk Assessment
A local user with CAP_CHECKPOINT_RESTORE can cause a kernel panic (denial of service) on systems with AMD GPUs. However, it requires special privileges, limiting the attack vector.
Recommendation
Update the Linux kernel to a version with the fix. Restrict granting CAP_CHECKPOINT_RESTORE to trusted processes.
Other vulnerabilities in Linux kernel (drm/amdkfd)
See all- CVE-2026-89810High
In the Linux kernel, the drm/amdkfd driver had an error-path bug in svm_migrate_copy_to_ram. When page migration from device to system RAM fails, the driver used a DMA address instead of the page physical address (pfn) to release and unlock allocated system pages, which is incorrect with IOMMU enabled. The fix releases pages based on struct page* and performs dma_unmap on the corresponding system RAM pages.
- CVE-2026-89808High
In the Linux kernel, the drm/amdkfd driver had a bug when the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocated device pages, and an uninitialized variable r could trigger out_free_vram_pages to drop all just-set-up VRAM. The fix initializes r and only calls the final svm_migrate_copy_memory_gart if j > 0.
- CVE-2026-45878High
A vulnerability has been identified in the Linux kernel related to improper bounds checking of watch_id in address debugging. Passing a large watch_id from userspace can lead to buffer overflow errors and invalid memory access.
- CVE-2024-49991High
A vulnerability has been identified and resolved in the Linux kernel within the drm/amdkfd module. The issue was related to improper pointer clearing, which could lead to a use-after-free bug.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd().