CVE-2026-53144

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel KFD

Publication date: 2026-06-25

Last updated on: 2026-07-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL dereference in get_queue_ids() When usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() returns NULL. The callers check only IS_ERR() on the return value; since IS_ERR(NULL) == false the check passes, and suspend_queues() calls q_array_invalidate() which immediately dereferences NULL while iterating num_queues times. Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying num_queues > 0 with a zero queue_array_ptr, causing a kernel panic. A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op (q_array_invalidate never executes, and resume_queues already guards all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL) only when num_queues is non-zero and the pointer is absent; both callers already propagate IS_ERR() returns correctly to userspace. (cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-07

Generated

2026-07-15

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53144

EUVD

EUVD-2026-39235

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.5 (inc) to 6.6.143 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the NULL dereference in get_queue_ids() in the drm/amdkfd component.

Avoid using the kfd_ioctl_set_debug_trap() ioctl with num_queues greater than zero and a NULL queue_array_ptr, as this can trigger the kernel panic.

Executive Summary

This vulnerability exists in the Linux kernel's drm/amdkfd component, specifically in the get_queue_ids() function. When the usr_queue_id_array pointer is NULL but the num_queues value is greater than zero, get_queue_ids() returns NULL. However, the callers only check if the return value is an error using IS_ERR(), and since IS_ERR(NULL) returns false, the check passes incorrectly. As a result, suspend_queues() calls q_array_invalidate(), which dereferences the NULL pointer while iterating num_queues times, causing a kernel panic.

Userspace can trigger this vulnerability by calling kfd_ioctl_set_debug_trap() with num_queues greater than zero and a zero queue_array_ptr, leading to the kernel panic.

Impact Analysis

This vulnerability can cause a kernel panic, which means the Linux system can crash unexpectedly. Such crashes can lead to denial of service, disrupting normal operations and potentially causing data loss or system instability.

Hi! I’m here to help you understand CVE-2026-53144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70