CVE-2024-56666

What it actually does

Null pointer returned by kfd_get_process_device_data is dereferenced without a check inside pqm_uninit, resulting in a kernel-level null dereference that can trigger a panic or memory corruption.

Why it matters to the business

Linux systems using AMD KFD may suffer unexpected kernel crashes and reboots when the affected code path executes, producing denial of service and loss of availability.

How an attack unfolds

An attacker triggers the pqm_uninit function (for example via process termination or device unbind on an AMD GPU) so that kfd_get_process_device_data returns null; the subsequent dereference immediately faults the kernel.

How to fix it

Apply the upstream fix in commit 768442d918932c4da09003f1fd6be1750b93a4ba or upgrade to a kernel that includes this commit; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 768442d918932c4da09003f1fd6be1750b93a4ba; attempt to exercise pqm_uninit paths while monitoring for null-dereference oops entries.

Typical attack path

1. Obtain local access or the ability to manage AMD KFD processes on a vulnerable kernel
2. Cause execution of pqm_uninit with a null device data pointer
3. Trigger the unguarded dereference to crash the kernel

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing amdkfd and pqm_uninit; correlate with process termination events on AMD GPUs.

• amdkfd.*pqm_uninit
• kfd_get_process_device_data
• Unable to handle kernel NULL pointer dereference

What your security team should do

• Patch Linux kernels to the fixed commit on all systems exposing AMD KFD
• Prioritize systems that run GPU workloads or allow unprivileged process termination
• Monitor for kernel panics referencing amdkfd after patching