-

CVE-2026-89807

drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

Both create_queue_cpsch() and create_queue_nocpsch() unconditionally
call mqd_mgr->restore_mqd() when a CRIU restore is in progress
(qd != NULL), with no NULL guard. On any system where restore_mqd is
not implemented for the given queue type, a user holding
CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference
and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a
crafted queue restore object. Note that checkpoint_mqd is likewise
unimplemented on GFX12, so no legitimate CRIU image can reach this
path — only a hand-crafted restore payload.

Add a NULL guard for restore_mqd immediately after mqd_mgr is
resolved, unwinding via the existing error labels and returning
-EOPNOTSUPP if the callback is not implemented. This mirrors the
existing checkpoint_mqd guard in checkpoint_mqd().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719
Version < 19c73848493ab58e39649700da6de11710a36de1
Status affected
Version 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719
Version < ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21
Status affected
Version 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719
Version < c643c229babe2e8efc5eefe60e19d44868a643ff
Status affected
Version 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719
Version < 6aa530642f95d5c48aa336416f94a35e7949b647
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.11
Status affected
Version 0
Version < 6.11
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.102
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/19c73848493ab58e39649700da6de11710a36de1
https://git.kernel.org/stable/c/ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21
https://git.kernel.org/stable/c/c643c229babe2e8efc5eefe60e19d44868a643ff
https://git.kernel.org/stable/c/6aa530642f95d5c48aa336416f94a35e7949b647