Executive brief
A race condition exists in the Linux kernel's AMD GPU driver (amdgpu) when switching hardware partitions. This flaw could allow a local user to cause a system crash or potentially execute unauthorized actions by triggering a timing conflict during process termination. The issue specifically affects systems using AMD hardware with Kernel Fusion Driver (KFD) functionality.
Technical details
A race condition exists in the amdkfd component of the Linux kernel's amdgpu driver. The vulnerability occurs because the 'switch partition' logic only checks if the 'kfd_processes_table' is empty, but process teardown occurs asynchronously in 'kfd_process_wq_release'. If a partition switch occurs while a process is being torn down in the workqueue, a race condition is triggered where 'kfd_node' members are accessed after they have been freed. This can result in a kernel 'divide error' or other memory corruption issues. The fix introduces an atomic 'kfd_processes_count' per device to ensure all process teardowns are complete before proceeding with a partition switch.
Affected products
- Linux Linux Kernel 0c7315e7d5ef9b36ca4db32ffeb34a187cbaf231 to 536d80f660ec12058e461f4db387ea42bee9250d
Timeline
- 2025-09-24: other: Patch authored
- 2025-12-16: disclosed: CVE published