CVE-2024-36951

What it actually does

Missing range validation on exception codes generated by CP interrupt packets allows garbage values to be delivered to the debugger and userspace runtime instead of being filtered.

Why it matters to the business

Systems running unpatched kernels may experience unexpected GPU debugging failures or incorrect exception handling in compute workloads, increasing operational risk for organizations that rely on AMD GPU acceleration.

How an attack unfolds

An attacker with the ability to trigger malformed CP packets on an AMD GPU can cause the kernel to surface invalid exception codes; the absence of range checks lets these codes propagate to user-space components that trust the values.

How to fix it

Upgrade the Linux kernel to a version containing commit 41dc6791596656dd41100b85647ed489e1d5c2f2 or later; rebuild and reboot all affected nodes with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel contains commit 41dc6791596656dd41100b85647ed489e1d5c2f2, then verify that exception code paths now perform explicit range checks before delivering values to user space.

Typical attack path

1. Obtain code execution or packet injection capability on the target AMD GPU
2. Craft and submit malformed CP packets that trigger the known interrupt bug
3. Receive unvalidated garbage exception codes in the debugger or runtime
4. Leverage the unexpected codes to induce crashes, bypass checks, or escalate privileges

How to detect it

Search kernel logs and audit trails for unexpected exception codes originating from amdkfd or drm modules; look for processes interacting with /dev/kfd that receive or log out-of-range codes after GPU packet activity.

What your security team should do

• Prioritize kernel upgrades on all systems exposing AMD GPUs to untrusted workloads
• Monitor vendor kernel update channels for backports of the referenced commit
• Review GPU debugging and compute runtime configurations for any reliance on exception code values
• Test patched kernels in staging before broad deployment to avoid boot or driver regressions