Executive brief
The Linux kernel's AMD KFD (Kernel Fusion Driver) GPU queue management code did not properly validate that certain queue restore operations were implemented before attempting to call them. A local attacker with CAP_CHECKPOINT_RESTORE capability could craft a malicious queue restore request that triggers a NULL pointer dereference, causing the kernel to crash and resulting in denial of service.
Technical details
The vulnerability exists in the drm/amdkfd driver's create_queue_cpsch() and create_queue_nocpsch() functions, which unconditionally invoke the mqd_mgr->restore_mqd() callback during CRIU (Checkpoint/Restore in Userspace) queue restore operations without first checking if the callback is implemented. On GPU types where restore_mqd is not implemented (such as GFX12), a NULL pointer dereference occurs. The attack requires local access and the CAP_CHECKPOINT_RESTORE capability, and is triggered via the KFD_IOC_CRIU_OP_RESTORE ioctl with a crafted queue restore object. The fix adds a NULL guard that returns -EOPNOTSUPP if restore_mqd is not available, mirroring existing validation for checkpoint_mqd.
Affected products
- Linux Linux kernel Affected versions likely 5.17+ (introduced by commit 48f0bdf4e38e adding GFX12 support); patched in stable and upstream
Timeline
- 2026-09-16: disclosed: CVE-2026-89807 published
- 2026-08-25: patched: Upstream commit 6aa530642f95d5c48aa336416f94a35e7949b647 merged
- 2026-09-14: patched: Patch released in stable kernel (commit 19c73848493ab58e39649700da6de11710a36de1)