CVE-2026-89807drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 builds before 19c73848493ab58e39649700da6de11710a36de1; from 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 before ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21; from 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 before c643c229babe2e8efc5eefe60e19d44868a643ff; 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 builds before 6aa530642f95d5c48aa336416f94a35e7949b647 | CNA record |
References
- https://git.kernel.org/stable/c/19c73848493ab58e39649700da6de11710a36de1
- https://git.kernel.org/stable/c/ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21
- https://git.kernel.org/stable/c/c643c229babe2e8efc5eefe60e19d44868a643ff
- https://git.kernel.org/stable/c/6aa530642f95d5c48aa336416f94a35e7949b647
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.