Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdkfd). If a user interacts with the system's memory management features in a specific incorrect order, it can cause the system to crash. This primarily impacts the stability and availability of systems using AMD graphics hardware.
Technical details
A NULL pointer dereference exists in the 'svm_range_set_attr' function within the 'drivers/gpu/drm/amd/amdkfd/kfd_svm.c' component of the Linux kernel. The vulnerability occurs because 'process_info' is not validated before being used to acquire a mutex lock. An attacker or a malformed local application can trigger this by calling 'kfd_ioctl_svm' without first calling 'kfd_ioctl_acquire_vm'. This results in a kernel oops/crash (Denial of Service). The issue has been resolved by adding a NULL check for 'process_info' that returns -EINVAL if the prerequisite initialization has not occurred.
Affected products
- Linux Linux 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/2f9c3c161692f5bf1436e869a651bed10936e071
- https://git.kernel.org/stable/c/6495cc09f7e6c2af571b3e2e4640283b3792ebf2
- https://git.kernel.org/stable/c/c24eee21f9a943374fd64260a6e17dc3984e3d0e
- https://git.kernel.org/stable/c/d4e73a047d4ea866b75ee4b879d0d787dfa2704c
- https://git.kernel.org/stable/c/e4dcb5d6360319609bc5b05fb40e98b0af6bc674
- https://git.kernel.org/stable/c/e984d61d92e702096058f0f828f4b2b8563b88ce