CVE-2024-36022

What it actually does

Race condition during amdgpu driver reload after unload in passthrough setups skips zone device and DRM client initialization when KFD init runs inside the mode-1 reset handler, resulting in kernel panic on subsequent application access.

Why it matters to the business

Virtualized systems with AMD GPUs experience unexpected crashes and downtime during driver reload operations, interrupting workloads until manual intervention or reboot occurs.

How an attack unfolds

An attacker with local access unloads then reloads the amdgpu driver; the resulting mode-1 reset triggers KFD initialization before zone device and DRM client setup completes, causing a panic when user-space applications interact with the GPU.

How to fix it

Upgrade the Linux kernel to version 6.8.9-1 or later on Debian 13 systems; apply equivalent fixes in other distributions once available.

How to confirm the fix worked

Confirm installed kernel version meets or exceeds 6.8.9-1, then perform controlled unload/reload cycles of amdgpu in a passthrough test environment while monitoring for panics.

Typical attack path

1. Obtain local access on affected Linux system
2. Unload amdgpu kernel module
3. Trigger module reload to initiate mode-1 reset
4. KFD initialization proceeds without zone device or DRM client
5. User-space GPU access triggers kernel panic

How to detect it

Review kernel logs for amdgpu or KFD related panic messages occurring immediately after module reload events in passthrough environments.

What your security team should do

• Prioritize kernel upgrade to 6.8.9-1 across all affected hosts
• Restrict unprivileged module unload/reload where possible
• Include driver reload tests in pre-production validation