CVE-2026-80870
Received Received - Intake

Integer Overflow Validation in AMDKFD Linux Kernel Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80870
EUVD
EUVD-2026-71500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of IDs restored during CRIU (Checkpoint/Restore In Userspace) operations. The KFD (Kernel Fusion Driver) restore flow restores object IDs from userspace without validating if they fit within signed integer limits. If a restored ID exceeds INT_MAX, it triggers a kernel WARN, which can cause a panic or reboot on systems with panic_on_warn enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's KFD CRIU restore functionality. Detection requires checking kernel logs for IDR layer warnings or kernel panics related to invalid ID ranges. Monitor dmesg for WARN traces or system crashes after CRIU operations.

Impact Analysis

This vulnerability can cause system instability or crashes if invalid IDs are restored during CRIU operations. Systems with panic_on_warn enabled may reboot unexpectedly. It could also lead to denial-of-service conditions if attackers exploit the unchecked userspace input to trigger kernel warnings.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for CVE-2026-80870. The patch adds validation to ensure restored IDs do not exceed INT_MAX before using them in idr_alloc calls. Update your kernel to a version containing this fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart