CVE-2022-3108

What it actually does

The function kfd_parse_subtype_iolink fails to check the return value of kmemdup, permitting a NULL pointer to be dereferenced and triggering a kernel panic.

Why it matters to the business

Local denial-of-service conditions can halt Linux systems using AMD GPUs, interrupting workloads and requiring reboots on servers and workstations.

How an attack unfolds

A local attacker invokes the AMD KFD driver CRAT parsing routine with data that forces kmemdup to fail, resulting in an unchecked NULL dereference and immediate kernel crash.

How to fix it

Upgrade the Linux kernel to a version containing the missing return-value check after kmemdup in drivers/gpu/drm/amd/amdkfd/kfd_crat.c.

How to confirm the fix worked

Inspect the kfd_crat.c source for NULL checks following kmemdup calls; reproduce the code path on AMD hardware and confirm absence of panic.

Typical attack path

1. Obtain local user privileges on the target system
2. Trigger AMD KFD IO-link subtype parsing via userspace interface
3. Supply input that causes kmemdup allocation failure
4. Trigger NULL pointer dereference and kernel panic

How to detect it

Search kernel logs and crash dumps for references to kfd_parse_subtype_iolink or amdkfd module panics following allocation failures.

What your security team should do

• Apply current Linux kernel updates to all affected systems
• Restrict unprivileged access to GPU compute interfaces where feasible
• Monitor kernel logs for amdkfd-related oops messages