CVE-2026-53144: Linux Kernel AMDKFD DOS Vulnerability

CVE-2026-53144 Overview

CVE-2026-53144 is a NULL pointer dereference vulnerability in the Linux kernel's AMD Kernel Fusion Driver (drm/amdkfd). The flaw resides in the get_queue_ids() function, which returns NULL when usr_queue_id_array is NULL and num_queues is non-zero. Callers validate the return value using IS_ERR(), but IS_ERR(NULL) evaluates to false, so the check passes. The downstream suspend_queues() call then invokes q_array_invalidate(), which dereferences NULL while iterating num_queues times. Userspace can trigger the panic via kfd_ioctl_set_debug_trap().

Critical Impact
Local unprivileged users with access to the AMD KFD ioctl interface can trigger a kernel panic, causing denial of service on affected Linux systems with AMD GPUs.

Affected Products

Linux kernel (mainline) — drm/amdkfd driver
Stable kernel branches receiving the cherry-picked fix from commit f165a82cdf50
Systems using AMD GPUs with the KFD compute stack enabled

Discovery Timeline

2026-06-25 - CVE-2026-53144 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53144

Vulnerability Analysis

The bug is a [CWE-476] NULL pointer dereference in the AMD Kernel Fusion Driver. The function get_queue_ids() is intended to copy a user-supplied array of queue identifiers from userspace into a kernel buffer. When usr_queue_id_array is NULL but num_queues is greater than zero, the function returns a plain NULL instead of an ERR_PTR() encoded error value.

Both callers validate the return using IS_ERR(). Because IS_ERR(NULL) returns false, the callers treat the NULL pointer as a valid array. suspend_queues() then calls q_array_invalidate(), which immediately dereferences the NULL pointer inside a loop that runs num_queues times. The result is a kernel oops or panic.

Root Cause

The root cause is an inconsistent error-signaling contract between get_queue_ids() and its callers. The function returns NULL for one error condition and ERR_PTR() for others, while callers only test for ERR_PTR() style errors. A NULL array with num_queues == 0 is a legitimate no-op, so the fix returns ERR_PTR(-EINVAL) only when num_queues is non-zero and the user pointer is absent.

Attack Vector

A local user invokes the kfd_ioctl_set_debug_trap() ioctl on /dev/kfd with num_queues > 0 and queue_array_ptr set to zero. The malformed parameters propagate to get_queue_ids(), which returns NULL. The kernel then dereferences this pointer in q_array_invalidate() during queue suspension. Exploitation requires only access to the KFD device node, which is commonly available to users running GPU compute workloads. The impact is limited to denial of service through a kernel panic; no privilege escalation or memory disclosure vectors have been identified.

The upstream fix is cherry-picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4. See the Kernel Git Commit e1965e8 for the patched source.

Detection Methods for CVE-2026-53144

Indicators of Compromise

Kernel oops or panic messages in dmesg referencing q_array_invalidate, suspend_queues, or get_queue_ids in the call trace
Unexpected system crashes on hosts running AMD GPU compute workloads (ROCm, HIP, OpenCL)
Processes invoking kfd_ioctl_set_debug_trap() with anomalous parameter combinations

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for NULL pointer dereference stack traces originating in the amdkfd driver
Audit ioctl calls to /dev/kfd using eBPF or auditd rules to identify unexpected debug-trap invocations
Correlate kernel crash dumps via kdump with process accounting to identify the triggering binary

Monitoring Recommendations

Enable kernel crash collection (kdump, crashkernel=) on AMD GPU hosts to capture forensic evidence
Track running kernel versions across the fleet and flag hosts that have not received the stable patch
Alert on repeated amdkfd-related kernel warnings, which may indicate fuzzing or exploitation attempts

How to Mitigate CVE-2026-53144

Immediate Actions Required

Apply the upstream kernel patch from commit f165a82cdf50 or the corresponding stable backports referenced in the kernel.org commits
Update to a distribution kernel that includes the fix once released by your vendor
Restrict access to /dev/kfd to trusted users and service accounts where possible

Patch Information

The fix changes get_queue_ids() to return ERR_PTR(-EINVAL) when num_queues is non-zero and usr_queue_id_array is NULL, while preserving the legitimate no-op case when both are zero. Stable backports are tracked in Kernel Git Commit 2bd550b, Kernel Git Commit 62bd09e, Kernel Git Commit 72e259a, Kernel Git Commit daeceb0, and Kernel Git Commit e1965e8.

Workarounds

Tighten permissions on /dev/kfd so only members of a dedicated GPU compute group can open the device
Unload the amdkfd driver on systems that do not require GPU compute (modprobe -r amdkfd)
Use seccomp or LSM policies to block unexpected processes from issuing ioctl() against the KFD interface

bash

# Configuration example: restrict /dev/kfd access
sudo groupadd -r kfd-users
sudo chgrp kfd-users /dev/kfd
sudo chmod 0660 /dev/kfd

# Optional: prevent amdkfd from loading on non-compute hosts
echo 'blacklist amdkfd' | sudo tee /etc/modprobe.d/blacklist-amdkfd.conf
sudo update-initramfs -u