CVE-2024-49991
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability has been identified and resolved in the Linux kernel within the drm/amdkfd module. The issue was related to improper pointer clearing, which could lead to a use-after-free bug.
Risk Assessment
Exploitation of this vulnerability could lead to unpredictable system behavior, posing risks to the stability and security of applications running on the Linux kernel.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and to monitor the system for potential exploits.
Other vulnerabilities in Linux kernel, drm/amdkfd
See all- CVE-2026-89810High
In the Linux kernel, the drm/amdkfd driver had an error-path bug in svm_migrate_copy_to_ram. When page migration from device to system RAM fails, the driver used a DMA address instead of the page physical address (pfn) to release and unlock allocated system pages, which is incorrect with IOMMU enabled. The fix releases pages based on struct page* and performs dma_unmap on the corresponding system RAM pages.
- CVE-2026-89808High
In the Linux kernel, the drm/amdkfd driver had a bug when the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocated device pages, and an uninitialized variable r could trigger out_free_vram_pages to drop all just-set-up VRAM. The fix initializes r and only calls the final svm_migrate_copy_memory_gart if j > 0.
- CVE-2026-89807Low risk· EPSS 9%
In the Linux kernel, the drm/amdkfd driver lacked a NULL guard for restore_mqd during CRIU queue restore. A user with CAP_CHECKPOINT_RESTORE could trigger a kernel NULL pointer dereference and panic by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. The fix adds a NULL guard and returns -EOPNOTSUPP if the callback is not implemented.
- CVE-2026-45878High
A vulnerability has been identified in the Linux kernel related to improper bounds checking of watch_id in address debugging. Passing a large watch_id from userspace can lead to buffer overflow errors and invalid memory access.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer Pass pointer reference to amdgpu_bo_unref to clear the correct pointer, otherwise amdgpu_bo_unref clear the local variable, the original pointer not set to NULL, this could cause use-after-free bug.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS