Executive brief
A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to cause a system crash. The issue occurs during specific cleanup operations where the system attempts to access memory that has already been cleared. This results in a kernel hang, leading to a complete denial of service for the affected machine.
Technical details
A NULL pointer dereference exists in the drm/amdkfd driver due to an incorrect teardown sequence in the kfd_exit function. When the KFD debugfs is destroyed (kfd_debugfs_fini) before the KFD workqueue (kfd_process_destroy_wq), the workqueue may attempt to call kfd_debugfs_remove_process. This function tries to recursively remove entries under /sys/kernel/debug/kfd/proc/<pid> using a dentry that has already been freed, causing the kernel to hang. The fix reorders the cleanup sequence to ensure the workqueue is destroyed before the debugfs infrastructure is finalized. This is reachable by local users with sufficient privileges to trigger module unloading or process cleanup involving the AMD KFD driver.
Affected products
- Linux Linux Kernel 3.19 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4
Timeline
- 2025-09-05: advisory: Initial NVD publication
- 2025-08-06: patched: Fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/2e58401a24e7b2d4ec619104e1a76590c1284a4c
- https://git.kernel.org/stable/c/74ee7445c3b61c3bd899a54bd82c1982cb3a8206
- https://git.kernel.org/stable/c/910735ded17cc306625e7e1cdcc8102f7ac60994
- https://git.kernel.org/stable/c/96609a51e6134542bf90e053c2cd2fe4f61ebce3
- https://git.kernel.org/stable/c/fc35c955da799ba62f6f977d58e0866d0251e3f8
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html