Executive brief
The Linux kernel's AMD KFD (Heterogeneous System Architecture) GPU compute driver contains a use-after-free vulnerability in memory mapping operations. A race condition allows one thread to access or operate on GPU memory objects after another thread has freed them, potentially causing system crashes, information disclosure, or privilege escalation on systems with AMD GPUs.
Technical details
The vulnerability is a use-after-free (UAF) flaw in the AMD KFD driver's character device interface, specifically in the `kfd_ioctl_map_memory_to_gpu()` and `kfd_ioctl_unmap_memory_from_gpu()` functions. The root cause is a race condition where kgd_mem pointers are accessed after releasing the process mutex (p->mutex). Once the mutex is unlocked, another thread can deallocate the buffer object, leaving dangling pointers that are subsequently used in `amdgpu_amdkfd_gpuvm_sync_memory()` and TLB flush operations. The fix relocates the mutex unlock to occur only after all access to the kgd_mem object is complete, ensuring safe memory lifecycle management. No authentication is required as this is reachable through unprivileged ioctl calls to the KFD character device.
Affected products
- Linux Linux kernel multiple kernel versions (fix applied to 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y and later stable branches)
Timeline
- 2023-04-06: disclosed: Fix committed to Linux kernel stable tree by Greg Kroah-Hartman
- 2023-04-06: patched: Upstream commit 9da050b0d9e04439d225a2ec3044af70cdfb3933 by Chia-I Wu, integrated into stable branches
- 2025-12-09: advisory: CVE-2023-53816 advisory published on NVD