CVE-2026-43444

What it actually does

The error handling path in the AMD KFD queue update code fails to unreserve a buffer object before returning failure, leaving kernel resources in an inconsistent state that can result in memory corruption or denial of service.

Why it matters to the business

Systems using AMD GPUs may experience kernel instability or crashes under specific local workload conditions, leading to unplanned downtime and potential data loss on affected Linux deployments.

How an attack unfolds

A local attacker with low privileges triggers the queue update failure path in the amdkfd driver, causing the kernel to skip the unreserve operation and corrupt internal buffer tracking structures.

How to fix it

Apply the upstream fix from commit c24afed7de9ecce341825d8ab55a43a254348b33 or later equivalent kernel updates that ensure BO unreservation occurs on all error paths in drm/amdkfd.

How to confirm the fix worked

Confirm the presence of the error-handling change in the amdkfd queue update code and test that queue update failures now correctly release reserved buffer objects without leaving kernel state inconsistent.

Typical attack path

1. Obtain local user access on a Linux system with an AMD GPU
2. Load or exercise the amdkfd driver through graphics or compute workloads
3. Force a queue update operation to fail
4. Trigger the buggy error path that omits the BO unreserve call
5. Observe resulting kernel memory state corruption or crash

How to detect it

Review kernel logs for amdkfd-related warnings or failures around queue updates and buffer object reservation; look for unexpected crashes or memory errors following graphics driver activity.

What your security team should do

• Prioritize kernel updates containing the referenced commit for all AMD GPU Linux systems
• Monitor for local privilege or graphics-related kernel panics as potential indicators
• Restrict untrusted local access on multi-user systems until patched