CVE-2026-89807: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: guard against NULL restoremqd in CRIU queue restore
Both createqueuecpsch() and createqueuenocpsch() unconditionally call mqdmgr->restoremqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restoremqd is not implemented for the given queue type, a user holding CAPCHECKPOINTRESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFDIOCCRIUOPRESTORE with a crafted queue restore object. Note that checkpointmqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload.
Add a NULL guard for restoremqd immediately after mqdmgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpointmqd guard in checkpointmqd().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In drm/amdkfd, update create_queue_cpsch() and create_queue_nocpsch() to add a NULL guard for mqd_mgr->restore_mqd immediately after mqd_mgr is resolved; unwind through the existing error labels and return -EOPNOTSUPP when the callback is not implemented.
Event History
Frequently Asked Questions
What level of access is required to trigger the failure?
An attacker must hold CAP_CHECKPOINT_RESTORE and be able to issue KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. The result can be a kernel NULL pointer dereference that panics the machine.
Are valid CRIU restore images sufficient to reach the vulnerable path?
For GFX12, checkpoint_mqd is also unimplemented, so no legitimate CRIU image can reach this path. Exploitation there requires a hand-crafted restore payload.
What is the practical mitigation if the fix cannot be deployed immediately?
Restrict CAP_CHECKPOINT_RESTORE to trusted users and prevent untrusted users from issuing KFD_IOC_CRIU_OP_RESTORE. The fix makes unsupported restore callbacks fail with -EOPNOTSUPP instead of dereferencing a NULL callback.