CVE-2026-97495: drm/amdkfd: Check bounds on allocate_doorbell
Published Sep 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check bounds on allocatedoorbell
allocateddoorbell has an option to set the doorbell id to a specific value (used by CRIU). This value was not bounds checked.
Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 24, 2026
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
Description
Data Sourced
via NVD·05:17 PM
Description
Frequently Asked Questions
1
What condition is required to trigger the issue?
An allocation request must set the doorbell ID to a specific value. This option is used by CRIU, and the supplied value was not checked to ensure it was below KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.
2
How can I determine whether a kernel includes the fix?
The resolved code checks that a specifically requested doorbell ID is less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS. The listed stable-kernel references identify commits containing the correction.