CVE-2024-57920

What it actually does

The vulnerability allows kfd_process_wq_release() to invoke dma_fence_signal() on a NULL eviction fence pointer when a kfd_process is closed immediately after creation via ioctl before kfd_process_device_init_vm() initializes ef.

Why it matters to the business

Systems running unpatched Debian 13 Linux kernels with AMD GPUs may experience kernel warning logs and potential minor instability during rapid process creation/termination in GPU-accelerated workloads; low urgency as the issue is not known to be exploited in the wild.

How an attack unfolds

An attacker with local access creates a KFD process through the amdgpu ioctl interface and immediately closes it, causing the workqueue handler to attempt signaling an uninitialized NULL dma_fence and emit a kernel warning; no remote vector or privilege escalation is present.

How to fix it

Upgrade the Linux kernel package to version 6.12.10-1 or newer on all Debian 13 systems; reboot after installation to load the corrected amdgpu module.

How to confirm the fix worked

Confirm installed kernel is 6.12.10-1 or later via uname -r; reproduce rapid KFD open/close operations and verify absence of dma_fence_signal warnings in dmesg.

Typical attack path

1. Obtain local shell access
2. Open a new kfd_process via KFD ioctl
3. Close the process before VM initialization completes
4. Trigger kfd_process_wq_release which calls dma_fence_signal on NULL

How to detect it

Search kernel logs and dmesg for the specific WARNING originating from drivers/dma-buf/dma-fence.c during execution of the kfd_process_wq workqueue in the amdgpu module.

• WARNING: CPU: .* at drivers/dma-buf/dma-fence.c:467 dma_fence_signal
• kfd_process_wq_release.*amdgpu
• Workqueue: kfd_process_wq kfd_process_wq_release

What your security team should do

• Schedule kernel upgrade to 6.12.10-1 across all affected hosts
• Add kernel log monitoring for dma_fence_signal warnings from amdgpu
• Limit unprivileged access to /dev/kfd until patches are deployed