CVE-2026-89807: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89807 Overview

CVE-2026-89807 is a NULL pointer dereference vulnerability in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) subsystem. The flaw resides in the Checkpoint/Restore in Userspace (CRIU) queue restore path used by AMD GPU compute workloads. Both create_queue_cpsch() and create_queue_nocpsch() unconditionally invoke mqd_mgr->restore_mqd() during a CRIU restore operation without checking whether the callback is implemented for the target queue type. A local user holding the CAP_CHECKPOINT_RESTORE capability can trigger the dereference by issuing a crafted KFD_IOC_CRIU_OP_RESTORE ioctl, panicking the kernel.

Critical Impact
A local user with CAP_CHECKPOINT_RESTORE can panic the kernel on affected AMD GPU platforms, causing full system denial of service.

Affected Products

Linux kernel with AMD Kernel Fusion Driver (drm/amdkfd)
Systems exposing the CRIU restore ioctl on GFX12-class AMD GPUs where restore_mqd is unimplemented
Distributions shipping the affected kernel prior to the fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89807 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89807

Vulnerability Analysis

The amdkfd driver implements CRIU checkpoint and restore support to allow live migration and snapshotting of GPU compute queues. During restore, the kernel resolves a Memory Queue Descriptor (MQD) manager for the queue type being restored and invokes its restore_mqd() callback to rehydrate the queue state from the saved image. The vulnerable code path assumes this callback is always populated whenever a restore descriptor (qd) is non-NULL.

On GPU generations such as GFX12, the restore_mqd callback is not implemented for certain queue types. Because the matching checkpoint_mqd callback is likewise unimplemented, no legitimate CRIU image can normally reach this code path. However, an attacker with CAP_CHECKPOINT_RESTORE can hand-craft a restore payload that references an unsupported queue type, forcing the kernel to dereference a NULL function pointer.

Root Cause

The root cause is a missing NULL guard on the mqd_mgr->restore_mqd function pointer inside create_queue_cpsch() and create_queue_nocpsch() [CWE-476: NULL Pointer Dereference]. The existing checkpoint_mqd() path already contained an equivalent guard, but the restore path did not mirror it. The upstream fix adds a NULL check immediately after mqd_mgr resolution, unwinds through existing error labels, and returns -EOPNOTSUPP when the callback is absent.

Attack Vector

Exploitation requires local access and the CAP_CHECKPOINT_RESTORE capability, which is typically granted to container runtime helpers and CRIU tooling. The attacker issues a KFD_IOC_CRIU_OP_RESTORE ioctl against /dev/kfd carrying a crafted queue restore object that targets a queue type without a restore_mqd implementation. Dereferencing the NULL callback triggers an oops and kernel panic, denying service to all users of the host.

No synthetic proof-of-concept is reproduced here. Refer to the upstream commits for the exact call-site diff and unwind logic.

Detection Methods for CVE-2026-89807

Indicators of Compromise

Kernel panic or oops messages referencing restore_mqd, create_queue_cpsch, or create_queue_nocpsch in dmesg or crashdumps.
Unexpected KFD_IOC_CRIU_OP_RESTORE ioctl activity against /dev/kfd from processes not associated with legitimate CRIU workflows.
Sudden host reboots on AMD GPU nodes running GFX12-class hardware without a preceding hardware event.

Detection Strategies

Audit process capability sets to enumerate binaries and containers granted CAP_CHECKPOINT_RESTORE, then correlate against expected CRIU tooling.
Deploy Linux auditd rules to log ioctl calls on /dev/kfd, capturing the calling UID, PID, and command number for later triage.
Alert on kernel crash telemetry that includes amdkfd frames in the backtrace, which typically indicates an attempt to reach the vulnerable path.

Monitoring Recommendations

Forward kernel logs and crashdumps from GPU compute nodes to a centralized logging pipeline for correlation with user activity.
Track container escape and capability-abuse patterns on multi-tenant Kubernetes nodes that expose AMD GPUs.
Baseline legitimate CRIU checkpoint/restore usage per workload so anomalous ioctl volume against /dev/kfd stands out.

How to Mitigate CVE-2026-89807

Immediate Actions Required

Apply the upstream Linux kernel patches or the equivalent backport shipped by your distribution vendor as soon as they are available.
Restrict CAP_CHECKPOINT_RESTORE to trusted service accounts and container runtimes; strip it from general workloads.
Limit access to /dev/kfd to users and containers that require AMD GPU compute functionality.

Patch Information

The vulnerability is fixed in the following upstream commits, which add the missing NULL guard for restore_mqd:

Workarounds

Disable CRIU-based checkpoint/restore workflows on affected AMD GPU nodes until the kernel patch is deployed.
Remove CAP_CHECKPOINT_RESTORE from container security profiles (for example, via Kubernetes securityContext.capabilities.drop) where CRIU is not required.
Use Linux Security Module policies (SELinux, AppArmor) to deny non-privileged processes access to /dev/kfd.