CVE-2026-68258: Linux Kernel Privilege Escalation Flaw

CVE-2026-68258 Overview

CVE-2026-68258 is a Linux kernel vulnerability in the AMD Kernel Fusion Driver (amdkfd) component of the Direct Rendering Manager (DRM) subsystem. The flaw exists in the Checkpoint/Restore in Userspace (CRIU) restore path for Kernel Fusion Driver (KFD) queues. The kernel failed to validate the queue type and mqd_size fields supplied through user-controlled private data before using them during restore operations. A local authenticated user can supply out-of-range values to trigger memory corruption or a kernel crash on systems with AMD GPU compute stacks enabled.

Critical Impact
A local low-privileged user can leverage missing bounds validation in the KFD CRIU restore interface to compromise kernel confidentiality and availability on affected AMD GPU systems.

Affected Products

Linux kernel builds including the AMD amdkfd DRM driver prior to the fix
Distributions shipping the vulnerable AMD GPU compute stack (ROCm-enabled kernels)
Systems using CRIU with KFD queue checkpoint and restore functionality

Discovery Timeline

2026-08-10 - CVE-2026-68258 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68258

Vulnerability Analysis

The vulnerability affects the AMD Kernel Fusion Driver (drm/amdkfd), which handles compute queues for AMD GPUs. During a CRIU restore operation, the kernel accepts private data from userspace that describes the queue state to reconstruct. Two fields in this private data, queue_type and mqd_size (Memory Queue Descriptor size), were consumed without validation.

A local attacker with permission to invoke the KFD restore ioctl can pass a queue_type value beyond the enumerated range. The kernel then uses this value to index into internal structures, producing out-of-bounds behavior. The mqd_size field determines how many bytes the kernel copies or allocates for the queue descriptor, so an unchecked value causes memory operations to run against attacker-influenced sizes.

The upstream fix introduces a KFD_QUEUE_TYPE_MAX sentinel and rejects any queue_type greater than or equal to it. It also adds a helper, mqd_size_from_queue_type, that computes the expected descriptor size and requires the caller-supplied mqd_size to match.

Root Cause

The root cause is improper input validation on user-supplied checkpoint metadata. The KFD CRIU restore path trusted values from the CRIU private-data blob and used them directly to select code paths and drive memory operations. This is a classic missing-bounds-check pattern in a privileged kernel interface exposed to unprivileged callers.

Attack Vector

Exploitation requires local access and the ability to invoke the KFD device interface, typically through /dev/kfd. An attacker crafts a malicious CRIU restore image containing an out-of-range queue_type or a mismatched mqd_size, then triggers the restore. The vulnerability is not remotely reachable and requires no user interaction beyond the attacker's own process.

The upstream patches referenced in the kernel git commit describe the fix in detail. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-68258

Indicators of Compromise

Unexpected kernel oops, panic, or WARN messages referencing amdkfd, kfd_criu_restore, or mqd in dmesg or /var/log/kern.log
Unprivileged processes opening /dev/kfd and issuing CRIU-related ioctls outside normal container migration workflows
Sudden crashes or hangs of GPU-using workloads correlated with checkpoint or restore activity

Detection Strategies

Monitor kernel logs for AMDKFD driver faults and correlate them with the process identifier and user identifier issuing the triggering ioctl.
Audit invocations of CRIU on hosts with AMD compute stacks and flag restore operations executed by non-administrative accounts.
Track loading of the amdkfd kernel module and enumeration of /dev/kfd by processes outside expected workloads such as ROCm applications.

Monitoring Recommendations

Enable kernel panic_on_oops on multi-tenant hosts to surface exploitation attempts as observable failures.
Forward kernel ring buffer events to a centralized logging system and alert on amdkfd driver errors.
Baseline normal CRIU restore activity so anomalous checkpoint images or unexpected callers are flagged for review.

How to Mitigate CVE-2026-68258

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor builds are available.
Restrict access to /dev/kfd to trusted users and workloads through group ownership and device permissions.
On hosts that do not require AMD GPU compute, blacklist or unload the amdkfd module to eliminate the attack surface.

Patch Information

The fix is available in stable kernel commits 47ea05f246be, cc10a5839756, and fd1691ec6270, cherry-picked from upstream commit f19d8086f664. Rebuild or update to a distribution kernel that includes these commits and reboot affected systems.

Workarounds

Deny non-administrative users the ability to invoke CRIU by removing CAP_CHECKPOINT_RESTORE and CAP_SYS_ADMIN from unprivileged workloads.
Use mandatory access control policies such as SELinux or AppArmor to prevent untrusted processes from opening /dev/kfd.
Where AMD compute is not required, prevent module autoload by adding blacklist amdkfd to a file in /etc/modprobe.d/.

bash

# Configuration example
# Block the amdkfd module on systems that do not need AMD GPU compute
echo 'blacklist amdkfd' | sudo tee /etc/modprobe.d/disable-amdkfd.conf
sudo depmod -a

# Restrict device node access to a trusted group
sudo groupadd -f kfd-users
sudo chown root:kfd-users /dev/kfd
sudo chmod 0660 /dev/kfd