Cloudanix VulnDB

CVE-2026-80870

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in how the Linux kernel accepts saved data when restarting graphics-related processes could let bad input cause warning messages or crashes on certain systems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unchecked userspace-supplied restore IDs in KFD CRIU paths reach idr_alloc() without INT_MAX range checks, allowing values that trigger WARN_ON in the IDR layer and potential panic when panic_on_warn is enabled.

Why it matters to the business

On systems configured with panic_on_warn, malicious or corrupted CRIU checkpoint data can cause kernel warnings that lead to unexpected reboots, reducing availability of GPU compute workloads; overall exploitation risk remains low given limited public interest.

How an attack unfolds

An attacker supplies a CRIU restore image containing an event or BO handle larger than INT_MAX, then invokes the KFD restore paths (kfd_criu_restore_event or criu_restore_memory_of_gpu). The invalid ID bypasses validation and is passed directly to idr_alloc, producing a kernel WARN that may panic the system.

How to fix it

Apply the upstream kernel patch that adds explicit INT_MAX validation returning -EINVAL in kfd_criu_restore_event and criu_restore_memory_of_gpu before any idr_alloc call; rebuild and deploy the fixed kernel across affected AMD GPU systems.

How to confirm the fix worked

Confirm the presence of the range check (restore_id <= INT_MAX) inside the two restore functions and verify that idr_alloc is no longer reachable with unvalidated user values; test with a deliberately oversized restore ID to ensure -EINVAL is returned instead of a WARN.

Typical attack path

  1. Craft or tamper with CRIU checkpoint data to embed an ID exceeding INT_MAX
  2. Trigger KFD CRIU restore via the amdkfd ioctl interface
  3. Force execution of create_signal_event/create_other_event or criu_restore_memory_of_gpu
  4. Reach idr_alloc with the out-of-range value to induce WARN/panic

How to detect it

Search kernel logs (dmesg, journalctl) for amdkfd or IDR WARN traces mentioning idr_alloc or restore_id values; correlate with CRIU restore activity on AMD GPU nodes.

What your security team should do

  • Prioritize patching kernels on GPU compute nodes that use CRIU for AMD KFD workloads
  • Audit any custom CRIU tooling that supplies KFD object IDs to ensure they stay within signed-int bounds
  • Enable kernel logging of amdkfd WARN messages and monitor for IDR-related traces as a temporary detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.

Affected packages

Ecosystem Package Introduced Fixed