CVE-2026-63882 Overview
CVE-2026-63882 is a NULL pointer dereference vulnerability in the Linux kernel's AMD Kernel Fusion Driver (amdkfd), specifically within the svm_range_set_attr function of the Shared Virtual Memory (SVM) subsystem. The process_info structure can be NULL when a user invokes the kfd_ioctl_svm ioctl without first calling kfd_ioctl_acquire_vm. Dereferencing this NULL pointer triggers a kernel crash, resulting in local denial of service. The issue has been resolved upstream and backported to multiple stable kernel branches.
Critical Impact
A local unprivileged user with access to the AMD KFD device node can crash the kernel by issuing kfd_ioctl_svm before acquiring a virtual machine context, causing denial of service on affected systems.
Affected Products
- Linux kernel builds containing the drm/amdkfd driver prior to the fix
- Systems using AMD GPUs with Shared Virtual Memory (SVM) support enabled
- Multiple stable kernel branches receiving the cherry-picked backport of commit 83a26c812e05
Discovery Timeline
- 2026-07-19 - CVE-2026-63882 published to the National Vulnerability Database
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63882
Vulnerability Analysis
The vulnerability resides in the svm_range_set_attr function within the AMD Kernel Fusion Driver (amdkfd), the component that enables heterogeneous compute workloads on AMD GPUs. The function assumes that process_info has been initialized before it is accessed. This assumption fails when userspace calls the kfd_ioctl_svm ioctl without first calling kfd_ioctl_acquire_vm, which is the ioctl responsible for allocating and registering the process VM context.
When the flawed code path executes, the kernel dereferences a NULL process_info pointer inside the SVM attribute-setting routine. This triggers an oops in kernel context and terminates the offending task, and in some configurations destabilizes the system. Because the KFD device node is typically accessible to unprivileged users belonging to the render or video groups, exploitation does not require elevated privileges.
Root Cause
The root cause is missing input-state validation [CWE-476: NULL Pointer Dereference]. The svm_range_set_attr code path did not check whether process_info was allocated before dereferencing it. The upstream fix, cherry-picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4, adds the necessary guard so that the function returns an error to userspace instead of dereferencing a NULL pointer.
Attack Vector
Exploitation is strictly local. An attacker with permission to open /dev/kfd issues the kfd_ioctl_svm ioctl without a prior kfd_ioctl_acquire_vm call. The crafted sequence forces the kernel to enter svm_range_set_attr with an uninitialized process_info, causing an immediate crash. There is no known path to remote exploitation or privilege escalation from this bug; the observable impact is denial of service.
Because no verified public proof-of-concept code is available, technical validation should reference the upstream fix commits listed in the kernel.org stable tree.
Detection Methods for CVE-2026-63882
Indicators of Compromise
- Kernel oops messages referencing svm_range_set_attr or amdkfd in dmesg or /var/log/kern.log.
- Unexpected task terminations with SIGSEGV-like backtraces originating from the KFD ioctl path.
- Repeated ioctl calls to /dev/kfd from non-GPU workloads or unexpected processes.
Detection Strategies
- Compare the running kernel version against the fixed commits (2f9c3c1, 6495cc0, c24eee2, d4e73a0, e4dcb5d, e984d61) to confirm patch status.
- Enable kernel crash reporting (kdump, pstore) to capture NULL pointer dereferences originating in drm/amdkfd.
- Audit which local accounts have read/write access to /dev/kfd and correlate unusual access with process ancestry.
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on BUG: kernel NULL pointer dereference events referencing amdkfd.
- Track process-to-device access patterns for /dev/kfd on multi-tenant hosts and GPU compute nodes.
- Baseline expected GPU-consuming workloads and flag ioctl activity from processes outside that baseline.
How to Mitigate CVE-2026-63882
Immediate Actions Required
- Apply the latest stable kernel update from your Linux distribution that includes the drm/amdkfd fix for svm_range_set_attr.
- Inventory hosts running AMD GPUs with the amdkfd module loaded and prioritize patching for multi-user or shared compute systems.
- Restrict access to /dev/kfd to trusted service accounts on systems where GPU compute is not required.
Patch Information
The fix is a cherry-pick of upstream commit 83a26c812e0529eb040d31a76f73e33e637243d4, which adds a NULL check on process_info before it is dereferenced in svm_range_set_attr. Backports have been merged into multiple stable branches via commits 2f9c3c1, 6495cc0, c24eee2, d4e73a0, e4dcb5d, and e984d61. Consult the kernel.org stable tree to identify the specific branch matching your deployed kernel.
Workarounds
- Unload the amdkfd module (modprobe -r amdkfd) on systems that do not require AMD GPU compute functionality.
- Tighten permissions on /dev/kfd so that only members of a dedicated GPU group can open the device.
- Use kernel Lockdown or Mandatory Access Control (SELinux, AppArmor) policies to constrain which processes can issue ioctls to the KFD device.
# Verify amdkfd module status and restrict device access
lsmod | grep amdkfd
ls -l /dev/kfd
# Optionally remove the module if GPU compute is not needed
sudo modprobe -r amdkfd
# Or restrict access to a trusted group
sudo chgrp render /dev/kfd
sudo chmod 0660 /dev/kfd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
