Executive brief
A debug interface in the Linux kernel's AMD GPU driver can crash the system when accessed while a GPU queue is active. An attacker with local access to kernel debug interfaces could trigger this crash, causing a denial of service to the affected system. This impacts systems with AMD GPUs where debug interfaces are exposed to unprivileged users.
Technical details
A NULL pointer dereference vulnerability exists in the pqm_debugfs_mqds() function within the AMD KFD (Kernel Fusion Driver) subsystem. The vulnerable code attempts to dereference an uninitialized mqd_mgr pointer when iterating over queue nodes where pqn->q is NULL (kernel-only queues). The root cause is incorrect code scoping: a for loop that calls mqd_mgr->debugfs_show_mqd() was placed outside the if (pqn->q) block that initializes mqd_mgr, causing NULL pointer dereference when accessing /sys/kernel/debug/kfd/mqds. The attack vector is local and requires read access to the debugfs interface. The fix involves moving the for loop inside the if block to ensure mqd_mgr is only dereferenced when properly initialized.
Affected products
- Linux Linux kernel affected versions prior to commit 8bfe29d5c798940f797aa24135d2734c3ffce9de
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix included in commit 8bfe29d5c798940f797aa24135d2734c3ffce9de