SB20260917161 - NULL pointer dereference in Linux kernel amd amdkfd driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-89807)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the AMD KFD device queue manager when restoring a CRIU queue through KFD_IOC_CRIU_OP_RESTORE. A local privileged user can issue the ioctl with a crafted queue restore object to cause a denial of service.

Exploitation is limited to queue types for which the restore_mqd callback is not implemented.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/19c73848493ab58e39649700da6de11710a36de1
• https://git.kernel.org/stable/c/6aa530642f95d5c48aa336416f94a35e7949b647
• https://git.kernel.org/stable/c/c643c229babe2e8efc5eefe60e19d44868a643ff
• https://git.kernel.org/stable/c/ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21