Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value. Confirm it's less than the maximum number of queues.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:27.410Z",
  "pubdate": "2026-09-24T17:17:27.410Z",
  "executiveSummary": "A bounds-checking vulnerability exists within the Linux kernel's amdkfd driver, specifically affecting the allocate_sdma_queue function.\nThe vulnerability allows an unvalidated user-supplied index to be utilized when restoring SDMA queue identifiers, typically during Checkpoint/Restore in Userspace (CRIU) operations.\nFailure to perform proper boundary validation against the maximum allowable number of SDMA queues leads to an out-of-bounds memory access condition.\nSuccessful exploitation could result in kernel memory corruption, leading to a system-wide denial-of-service (kernel panic) or potential privilege escalation if an attacker can manipulate the out-of-bounds write to influence kernel control flow.\nThe vulnerability is localized to the amdkfd subsystem and requires an attacker to have the ability to interact with the KFD character device, implying local user privileges are a prerequisite for exploitation.",
  "technicalDetails": "The root cause of this vulnerability is a missing bounds check in the allocate_sdma_queue function within the drm/amdkfd driver. The function accepts a restore_sdma_id parameter, which is intended to be used during the restoration of SDMA queue states, a feature primarily leveraged by CRIU. Because the kernel fails to verify that the provided restore_sdma_id is strictly less than the maximum defined number of SDMA queues, a caller can supply an arbitrary integer value.\nWhen this unchecked index is used to index into internal kernel data structures—likely an array of queue descriptors or memory pointers—it results in an out-of-bounds access. If the attacker provides a sufficiently large or malicious index, the kernel will perform read or write operations at an offset outside the intended memory region of the SDMA queue array.\nThe exploitation flow typically begins with an unprivileged process opening the /dev/kfd character device. Once access is obtained, the attacker can invoke the relevant ioctl interface that triggers the allocate_sdma_queue logic. By passing a crafted, out-of-bounds restore_sdma_id, the attacker can force the kernel to access memory segments adjacent to the legitimate queue structures. Depending on the memory layout and the specific operation (read vs write), this can lead to the following outcomes: 1) Kernel memory corruption, where the attacker overwrites critical kernel structures or function pointers; 2) Arbitrary information disclosure, where the kernel returns data from unauthorized memory locations; or 3) System instability resulting in a kernel panic due to invalid memory access (Segmentation Fault in kernel space).\nBecause the allocation occurs in kernel space, the lack of input sanitization provides a direct path for memory corruption. The vulnerability is highly dependent on the kernel configuration and the specific architecture of the amdkfd driver implementation. Since this is an interface used for debugging and checkpoint/restore operations, the requirement for local execution restricts the threat surface; however, in environments with multi-tenant users or shared containerized setups where access to the KFD device might be granted, this represents a significant security defect that violates the principle of kernel-level input validation."
}