CVE-2026-97497: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid
allocatesdmaqueue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value.
Confirm it's less than the maximum number of queues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Before allocating an SDMA queue, bounds-check the specified restore_sdma_id value and confirm it is less than the maximum number of queues.
Event History
Frequently Asked Questions
Who can supply the affected queue ID?
The optional SDMA queue ID is used by CRIU during queue restoration. Exploitation requires an actor able to invoke this restore path with a specified queue ID.
What validation was added by the fix?
The kernel now confirms that the supplied restore_sdma_id is less than the maximum number of SDMA queues before using it.
How can I identify systems needing remediation?
Review the Linux kernel source or applied stable patches for the referenced fixes and verify whether allocate_sdma_queue bounds-checks restore_sdma_id. The provided data does not identify affected kernel versions.