CVE-2026-80870: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Validate CRIU-restored IDs before idralloc
The KFD CRIU restore flow restores previously saved object IDs from userspace.
For event restore:
kfdcriurestoreevent() -> createsignalevent() / createotherevent() -> allocateeventnotificationslot() -> idralloc(..., restoreid, restoreid + 1, ...)
For BO restore:
criurestorememoryofgpu() -> idralloc(..., bopriv->idrhandle, ...)
In both cases, the restored ID comes from userspace-provided CRIU data.
idralloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INTMAX, it can trigger a WARN in the IDR layer.
A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with paniconwarn enabled.
Smatch reported these paths as allowing unchecked userspace values to reach idralloc().
Add INTMAX validation before using restored IDs in:
- kfdcriurestoreevent() - criurestorememoryofgpu()
If the restored ID is invalid, return -EINVAL.
This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the KFD CRIU restore flow, validate userspace-provided restored object/event IDs before using them in idr_alloc(). If a restored ID is larger than INT_MAX, return -EINVAL to avoid WARN-triggering paths in the IDR layer (idr_alloc expects ID range values to fit within signed int). Apply this validation for both BO restore paths and for event restore paths in kfd_criu_restore_event().
Linux kernel drm/amdkfd (KFD CRIU restore) INT_MAX validation for restored IDs before calling idr_alloc() = Enforce INT_MAX bounds and return -EINVAL when restored IDs are invalid
Event History
Frequently Asked Questions
What conditions are required to trigger the warning path?
The KFD CRIU restore flow must process userspace-provided restore data containing an event ID or BO ID larger than INT_MAX. Those unchecked values can reach idr_alloc() in the affected restore paths.
What is the practical impact of a malformed restored ID?
An oversized restored ID can cause a kernel WARN in the IDR layer, producing a warning trace. On systems configured with panic_on_warn, that warning may cause a panic or reboot.
What can be done before the fix is applied?
Ensure CRIU restore data supplied to KFD uses event and BO IDs no greater than INT_MAX. Invalid IDs should be rejected rather than passed to the restore flow.