Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy_queue_cpsch wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:20.907Z",
  "pubdate": "2026-09-24T17:17:20.907Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) race condition located within the Linux kernel's AMDKFD (AMD Kernel Fusion Driver) component, specifically affecting the queue destruction process.\nThe flaw stems from improper synchronization during the queue destruction sequence in destroy_queue_cpsch, where internal locks are released to await queue resumption.\nA local attacker with the ability to interact with the KFD interface could exploit this race condition to trigger a UAF, potentially leading to kernel memory corruption, arbitrary code execution, or system instability/denial-of-service.\nThe risk is categorized as high due to the potential for kernel-level impact, although it requires the ability to execute code in the context of the user-space driver API, typically limiting the attack surface to locally authenticated users with GPU access.\nNo specific network exposure is required as the vulnerability resides in the kernel's local driver interface.",
  "technicalDetails": "The root cause of the vulnerability lies in the concurrency management within the destroy_queue_cpsch function in the AMDKFD driver. During the teardown of a hardware queue, the function calls wait_on_destroy_queue() to ensure the queue has successfully resumed before proceeding with final destruction steps.\nDuring the execution of wait_on_destroy_queue(), the driver drops the protecting mutexes or spinlocks to permit the scheduler to process the resume operation. This creates a critical window of vulnerability where the kernel state is inconsistent.\nIf a concurrent request to destroy the same queue is issued during this window, the initial execution context may be preempted or raced. Because the locks were dropped, the second execution context can proceed to free the queue structure while the first context is still referencing the object pointer.\nThe vulnerability is addressed by introducing an 'is_being_destroyed' flag. This flag serves as a synchronization primitive, acting as an atomic indicator of the object's lifecycle state. By checking and setting this flag under lock, the driver ensures that only one destruction process can proceed, and any concurrent attempts are effectively serialized or blocked.\nThe attack flow involves: 1) An attacker initiates a queue destruction sequence via the KFD IOCTL interface. 2) The driver reaches the wait_on_destroy_queue() call, dropping the necessary locks. 3) The attacker triggers a second, concurrent destruction call targeting the same queue object handle. 4) The second call proceeds to finalize the destruction and deallocate the underlying memory associated with the queue. 5) When the first context resumes from the wait, it attempts to access the memory block, which has already been returned to the kernel allocator, resulting in a use-after-free condition.\nSuccessful exploitation could allow an attacker to manipulate kernel memory by reallocating the freed memory block with malicious data before the first context performs its UAF access. This pattern is often a precursor to privilege escalation or kernel control flow hijacking."
}