CVE-2026-89809: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89809 Overview

CVE-2026-89809 is a NULL pointer dereference vulnerability in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) component. The flaw resides in the pqm_debugfs_mqds function within the AMD GPU compute stack. Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a kernel crash. The issue occurs because a for loop calling mqd_mgr->debugfs_show_mqd() was incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. When the queue list contains kernel queue entries where pqn->q is NULL, the uninitialized mqd_mgr pointer is dereferenced, causing a kernel panic.

Critical Impact
Local users with access to the KFD debugfs interface can trigger a kernel NULL pointer dereference, resulting in a denial-of-service condition on systems using AMD GPUs with the amdgpu driver.

Affected Products

Linux kernel versions containing the vulnerable pqm_debugfs_mqds implementation in drm/amdkfd
Systems using the AMD GPU driver (amdgpu) with KFD compute queues enabled
Distributions shipping affected kernel builds prior to the upstream fix

Discovery Timeline

2026-09-16 - CVE-2026-89809 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89809

Vulnerability Analysis

The vulnerability exists in the pqm_debugfs_mqds function in the AMD Kernel Fusion Driver (KFD), which exposes Memory Queue Descriptor (MQD) diagnostic data through debugfs. When a process holds an active KFD queue, reading /sys/kernel/debug/kfd/mqds triggers iteration over the process queue node list. Queue nodes can represent either user queues (with pqn->q set) or kernel queues (where only pqn->kq is valid and pqn->q is NULL). The original code initialized the mqd_mgr pointer only inside an if (pqn->q) block, but the subsequent for loop that invoked mqd_mgr->debugfs_show_mqd() was placed outside that block. This scoping error caused the loop to execute unconditionally on every iteration.

Root Cause

The root cause is an incorrect code-block scope [CWE-476, NULL Pointer Dereference]. The mqd_mgr variable remains at its uninitialized declaration value (NULL) when the queue entry represents a kernel queue. The subsequent function pointer dispatch through mqd_mgr->debugfs_show_mqd(m, mqd) dereferences the NULL pointer and attempts an instruction fetch at address 0x0, producing a supervisor-mode page fault.

Attack Vector

A local user with permission to read debugfs entries can trigger the crash by reading /sys/kernel/debug/kfd/mqds while any process holds an active KFD queue that includes a kernel queue entry. Access to debugfs typically requires root or CAP_SYS_ADMIN, so exploitation is generally limited to privileged local contexts. The resulting kernel panic manifests as BUG: kernel NULL pointer dereference, address: 0000000000000000 with a call trace through pqm_debugfs_mqds+0x10c/0x1d0 and kfd_debugfs_mqds_by_process+0x9b/0x110 in the amdgpu module.

// Vulnerability described in prose; see upstream commit for the exact patch.
// Reference: https://git.kernel.org/stable/c/8bfe29d5c798940f797aa24135d2734c3ffce9de

Detection Methods for CVE-2026-89809

Indicators of Compromise

Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0
Call trace frames referencing pqm_debugfs_mqds and kfd_debugfs_mqds_by_process in the amdgpu module
Unexpected system crashes or hangs following reads of /sys/kernel/debug/kfd/mqds

Detection Strategies

Inventory hosts running the amdgpu driver with KFD compute enabled and verify the running kernel version against distribution advisories
Monitor dmesg and system journal output for AMD KFD-related NULL pointer dereference stack traces
Audit debugfs access permissions and identify processes or scripts that read /sys/kernel/debug/kfd/mqds

Monitoring Recommendations

Forward kernel oops and panic messages to a centralized logging pipeline for correlation
Alert on any process invoking open() or read() against paths under /sys/kernel/debug/kfd/
Track kernel package versions across the fleet to confirm timely deployment of the upstream fix

How to Mitigate CVE-2026-89809

Immediate Actions Required

Apply the upstream Linux kernel patch that moves the for loop inside the if (pqn->q) block in pqm_debugfs_mqds
Update to a distribution kernel release that incorporates the fix from commit 8bfe29d5c798940f797aa24135d2734c3ffce9de
Restrict debugfs mount access to trusted administrators only

Patch Information

The fix is available in the upstream Linux kernel stable tree. Reference the Kernel Git Commit 012a026b and Kernel Git Commit 58e86671 for the corrected scope of the mqd_mgr dereference. Rebuild and reboot affected systems after installing the patched kernel package supplied by your distribution.

Workarounds

Unmount debugfs or remount it with restrictive permissions to prevent access to /sys/kernel/debug/kfd/mqds
Disable the amdgpu driver on systems where AMD GPU compute (KFD) functionality is not required
Ensure only root-owned administrative processes can read files under /sys/kernel/debug/

bash

# Restrict access to debugfs (root only) and verify KFD debug entries are not world-readable
mount -o remount,mode=700 /sys/kernel/debug
ls -l /sys/kernel/debug/kfd/mqds