HIGH Introduced in 5.18
amdkfd Doorbell OOB
CVE-2026-97495
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocate_doorbell allocated_doorbell has an option to set the doorbell id to a specific value (used by CRIU). This value was not bounds checked. Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.
02KernelScan AI Analysis
Risk summary
A local attacker with access to AMD GPU hardware can trigger an out-of-bounds bit-set write in kernel heap memory via the amdkfd driver's CRIU restore path. The corruption can lead to kernel crashes or potential privilege escalation. Systems without AMD GPUs or without the amdkfd driver loaded are not affected.
Vulnerability analysis
When restoring a process from a checkpoint, the AMD GPU compute driver accepts a caller-supplied doorbell identifier without checking that it falls within the allocated tracking bitmap. An out-of-range value causes the kernel to set a bit past the end of the bitmap, corrupting adjacent kernel heap memory. The fix adds a bounds check that rejects identifiers exceeding the per-process queue limit before the bitmap is modified. This path is reachable locally on systems with AMD GPU hardware running the amdkfd driver, triggered through the GPU device interface during a checkpoint restore operation by a process with device access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.18 | 6.1.189 | 7e06636260a2 |
| 6.12 | 5.18 | 6.12.111 | e0cecd04a4fc |
| 6.18 | 5.18 | 6.18.53 | c2c89118c27c |
| 6.6 | 5.18 | 6.6.158 | 3d2ddfc9b361 |
| mainline | 5.18 | 7.2 | 1f087bb8cf9e |
| cip/6.1 | 5.18 | 6.1.189-cip61 | 7e06636260a2 |
| cip/6.1-rt | 5.18 | 6.1.189-cip61-rt32 | 7e06636260a2 |
| cip/6.12 | 5.18 | 6.12.111-cip32 | e0cecd04a4fc |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |