Not yet scoredPublished Sep 16, 2026

CVE-2026-89807drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

Updated under an hour ago (Oct 27, 2026, 1:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 builds before 19c73848493ab58e39649700da6de11710a36de1; from 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 before ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21; from 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 before c643c229babe2e8efc5eefe60e19d44868a643ff; 48f0bdf4e38e42b8285622cfcfc7e6e490b1a719 builds before 6aa530642f95d5c48aa336416f94a35e7949b647	CNA record

References

References

https://git.kernel.org/stable/c/19c73848493ab58e39649700da6de11710a36de1
https://git.kernel.org/stable/c/ebffa44e7a21ead59ac4b4264e8fc2cbb44c4a21
https://git.kernel.org/stable/c/c643c229babe2e8efc5eefe60e19d44868a643ff
https://git.kernel.org/stable/c/6aa530642f95d5c48aa336416f94a35e7949b647

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.