NULL pointer dereference in Linux kernel - CVE-2026-98905

Vulnerability identifier: #VU157606

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98905

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially cause a denial of service by crashing the kernel.

The vulnerability exists due to missing initialization of queue buffer fields in the AMD KFD queue restoration code when restoring GPU queues through CRIU. A local user can trigger queue restoration to leave buffer fields null, potentially causing a null pointer dereference when subsequent code accesses them.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/20a5e7ffdfecddc34c60a6b4483f42acf3d8731d
• https://git.kernel.org/stable/c/c6c290e408fe328e091f0bf7502a42b0deea82e9
• https://git.kernel.org/stable/c/e2dbdd14c3352483a89e4a9afda05d0f3fcc2c83

• NULL pointer dereference in Linux kernel amd amdkfd driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more