Look up another CVE · open CVE-2026-74446 in the interactive tracker
CVE-2026-74446
drm/amdkfd: hold event_mutex while checkpointing CRIU events
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74446 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count nor the walk holds p->event_mutex. The CRIU checkpoint caller holds only p->mutex. Event create and destroy (kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not take p->mutex, so a second thread in the same process can insert or remove events between the count and the walk. If an event is inserted, the walk iterates more entries than were counted and writes past the end of the ev_privs allocation; if an event is removed, the walk dereferences an entry that is being freed. Hold p->event_mutex across the count and the walk so both observe a consistent view of p->event_idr. The lock is released before copy_to_user(), which only touches the local buffer. The caller already holds p->mutex and the create/destroy paths never take p->mutex, so the p->mutex -> p->event_mutex order is not inverted and no deadlock is introduced. (cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/amd/amdkfd/kfd_events.c
- What this is
- AMD KFDMAINTAINERS section matched on drivers/gpu/drm/amd/amdkfd/ · amd-gfx@lists.freedesktop.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.18 | 6.1.183 | 8f7196f25b14 |
| 5.18 | 6.6.151 | 2040b7e39027 |
| 5.18 | 6.12.103 | 9a7f765985f6 |
| 5.18 | 6.18.44 | 6a52f48157fa |
| 5.18 | 7.1.8 | bed80be08c0b |
| 5.18 | 7.2 | ff8bc5a68a9a |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only through AMDKFD_IOC_CRIU_OP_CHECKPOINT on /dev/kfd, a local character-device ioctl in the amdgpu/amdkfd GPU compute stack, not via any network-facing kernel service.
- AC:LAttack complexity, low
- Exploitation needs a race between CRIU checkpoint and concurrent event create/destroy in the same KFD process; the attacker controls both threads and can repeat the ioctl and event churn until the TOCTOU window is hit reliably.
- PR:LPrivileges required, low
- CRIU checkpoint requires CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN, both obtainable by an unprivileged user via a user namespace (same model as other namespace-granted caps); GPU tenant access to /dev/kfd on ROCm/HPC nodes is sufficient.
- UI:NUser interaction, none
- No victim interaction is required beyond the attacker opening /dev/kfd and driving CRIU checkpoint and event ioctls from their own process threads.
- S:UScope, unchanged
- Impact is kernel heap corruption and privilege escalation within the host kernel security domain; it does not cross a guest/host or IOMMU/DMA trust boundary on its own.
- C:HConfidentiality impact, high
- Concurrent event removal causes the checkpoint walk to dereference kfd_event objects being freed (UAF), and OOB writes of 64-byte kfd_criu_event_priv_data entries can corrupt adjacent kernel memory to leak data.
- I:HIntegrity impact, high
- If events are inserted between kfd_get_num_events() and the IDR walk, the checkpoint loop writes past the end of the kvzalloc ev_privs buffer, enabling heap overflow and control of freed-object contents for arbitrary write primitives.
- A:HAvailability impact, high
- The UAF and heap out-of-bounds write can trigger kernel oops/panic during checkpoint or corrupt critical kernel structures, causing denial of service or system crash.