CVE-2026-72449

Received Received - Intake

Use-After-Free in AMDKFD Linux Kernel Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. (cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72449

EUVD

EUVD-2026-59348

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
amd	amdkfd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the AMDKFD driver. It involves a list corruption issue in the kfd_criu_resume_svm function where struct criu_svm_metadata objects are freed without being removed from a list. This leaves the list head pointing to freed memory, causing use-after-free and double-free issues when the function is called again.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDKFD driver and requires local access to /dev/kfd. Detection involves checking kernel logs for crashes or errors related to kfd_criu_resume_svm. Commands like dmesg | grep -i kfd or journalctl -k | grep -i kfd may help identify issues.

Impact Analysis

An unprivileged user in the render group can exploit this via /dev/kfd to cause memory corruption, crashes, or potential privilege escalation. The vulnerability requires no special capabilities and can be triggered repeatedly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a local kernel memory corruption issue in AMDKFD driver with no evidence of data exposure or privacy violations.

Mitigation Strategies

Apply the kernel patch that fixes the list_del corruption in kfd_criu_resume_svm. Update to a patched kernel version. If immediate patching is not possible, restrict access to /dev/kfd for unprivileged users as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70