CVE-2026-72449drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. (cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba before c8a8d350a273c005a48c64c4519d21b2a51c5ceb; from 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba before 506e635aed05dbdeef11e3c59f6e42980cda5b6d; from 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba before 838b57b3e7ce8cce0fda56d0861add3d464dd6c8; from 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba before 96ac562a9ea3020981f536384711190841c81aa8; from 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba before e33a3bd5cb8d0cf1557dee014115f812c9686130; from 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba before 8fa5655da368d0306c03e9dc9cda8ae2a7840926 | CNA record |
References
- https://git.kernel.org/stable/c/c8a8d350a273c005a48c64c4519d21b2a51c5ceb
- https://git.kernel.org/stable/c/506e635aed05dbdeef11e3c59f6e42980cda5b6d
- https://git.kernel.org/stable/c/838b57b3e7ce8cce0fda56d0861add3d464dd6c8
- https://git.kernel.org/stable/c/96ac562a9ea3020981f536384711190841c81aa8
- https://git.kernel.org/stable/c/e33a3bd5cb8d0cf1557dee014115f812c9686130
- https://git.kernel.org/stable/c/8fa5655da368d0306c03e9dc9cda8ae2a7840926
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.