Cloudanix VulnDB

CVE-2026-98905

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel restores graphics device state on certain AMD hardware can let an attacker crash the system or gain elevated access during checkpoint operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing call to kfd_queue_acquire_buffers() in set_queue_properties_from_criu() leaves queue buffer fields unpopulated (null), violating assumptions in later kernel code paths and enabling memory corruption during CRIU queue restore on AMD KFD devices.

Why it matters to the business

Systems performing checkpoint/restore of AMD GPU workloads (containers, VMs, or HPC jobs) face elevated risk of kernel instability or compromise; the issue affects recent kernels and requires prompt patching to maintain operational continuity.

How an attack unfolds

An attacker crafts or influences a CRIU checkpoint containing AMD KFD queue state, then triggers restore via set_queue_properties_from_criu(); the missing buffer acquisition leaves null pointers that subsequent code dereferences, resulting in memory corruption that can be leveraged for privilege escalation or denial of service.

How to fix it

Apply the upstream fix (commit 88ed96abbbe27b70193544fbc1ee06448c274714) or a later kernel containing the corrected set_queue_properties_from_criu() implementation; rebuild and deploy updated kernels across affected AMD GPU hosts.

How to confirm the fix worked

Confirm the presence of the kfd_queue_acquire_buffers() call and correct casts inside set_queue_properties_from_criu(); run CRIU restore tests on AMD KFD queues and verify no null buffer dereferences occur.

Typical attack path

  1. Identify or create a workload using AMD KFD queues on a vulnerable kernel
  2. Capture a CRIU checkpoint of the process
  3. Modify or replay the checkpoint to invoke the flawed restore path
  4. Trigger queue restoration and exploit resulting null dereference or corruption

How to detect it

Review kernel logs for null pointer dereferences or oopses originating from amdkfd during CRIU restore operations; correlate with process checkpoint/restore activity on AMD GPU nodes.

What your security team should do

  • Prioritize kernel updates on any hosts running AMD GPUs with CRIU or container migration workloads
  • Monitor for new stable kernel releases containing the referenced commit
  • Test CRIU restore functionality in staging environments after patching

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_from_criu() was missed. Thus, set_queue_properties_from_criu() is not filling out the buffer fields of queue_properties, which can come up when subsequent code expects them to be non-null. Add the proper call to kfd_queue_acquire_buffers(), and also use the right cast types in set_queue_properties_from_criu() (which were missed at the same time) (cherry picked from commit 88ed96abbbe27b70193544fbc1ee06448c274714)

Affected packages

Ecosystem Package Introduced Fixed