CVE-2026-72449 (GCVE-0-2026-72449)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:56 – Updated: 2026-08-17 05:44
VLAI
Title
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. (cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba , < c8a8d350a273c005a48c64c4519d21b2a51c5ceb (git)
Affected: 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba , < 506e635aed05dbdeef11e3c59f6e42980cda5b6d (git)
Affected: 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba , < 838b57b3e7ce8cce0fda56d0861add3d464dd6c8 (git)
Affected: 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba , < 96ac562a9ea3020981f536384711190841c81aa8 (git)
Affected: 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba , < e33a3bd5cb8d0cf1557dee014115f812c9686130 (git)
Affected: 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba , < 8fa5655da368d0306c03e9dc9cda8ae2a7840926 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8a8d350a273c005a48c64c4519d21b2a51c5ceb",
              "status": "affected",
              "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
              "versionType": "git"
            },
            {
              "lessThan": "506e635aed05dbdeef11e3c59f6e42980cda5b6d",
              "status": "affected",
              "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
              "versionType": "git"
            },
            {
              "lessThan": "838b57b3e7ce8cce0fda56d0861add3d464dd6c8",
              "status": "affected",
              "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
              "versionType": "git"
            },
            {
              "lessThan": "96ac562a9ea3020981f536384711190841c81aa8",
              "status": "affected",
              "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
              "versionType": "git"
            },
            {
              "lessThan": "e33a3bd5cb8d0cf1557dee014115f812c9686130",
              "status": "affected",
              "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
              "versionType": "git"
            },
            {
              "lessThan": "8fa5655da368d0306c03e9dc9cda8ae2a7840926",
              "status": "affected",
              "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix list_del corruption in kfd_criu_resume_svm\n\nThe cleanup tail of kfd_criu_resume_svm() walks\nsvms-\u003ecriu_svm_metadata_list and kfree()s each struct criu_svm_metadata\nwithout removing it from the list. The list head is left pointing at\nfreed kmalloc-96 objects.\n\nA second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty()\nreads the dangling -\u003enext (use-after-free), the loop walks freed entries,\nand each is kfree()\u0027d again (double-free). This is reachable by an\nunprivileged render-group user via /dev/kfd with no capabilities required.\n\nAdd list_del() before the kfree() so the list is properly emptied. The\nlist_for_each_entry_safe() iterator already caches the next pointer, so\nunlinking during the walk is safe.\n\n(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the local AMDKFD_IOC_CRIU_OP ioctl on /dev/kfd (unlocked_ioctl -\u003e kfd_ioctl_criu -\u003e criu_resume -\u003e kfd_criu_resume_svm); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - An attacker who can open /dev/kfd controls the full CRIU restore/resume ioctl sequence and can deterministically trigger the bug by issuing KFD_CRIU_OP_RESUME twice after restore populates criu_svm_metadata_list; no uncontrollable race or rare layout is required.\nPR:L - The fix commit and ioctl path show exploitation by a local render-group user opening /dev/kfd; CAP_CHECKPOINT_RESTORE/SYS_ADMIN gates CRIU ioctls but are obtainable in a user namespace, matching basic local user privilege rather than init-namespace root only.\nUI:N - Exploitation requires only the attacker\u0027s own ioctl calls to /dev/kfd after CRIU restore; no victim click, mount, file open, or other interactive action is needed.\nS:U - Corruption is confined to kernel heap list metadata in amdkfd for the calling KFD process context; impact stays within the kernel security authority and does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - After the first resume, list_empty() and list iteration dereference freed kmalloc-96 criu_svm_metadata objects (use-after-free reads of -\u003enext/list pointers), enabling attacker-influenced heap disclosure beyond a bounded leak.\nI:H - A second resume walks the corrupted list and kfree()s the same objects again (double-free on kmalloc-96 slabs), a standard exploitable kernel heap primitive for arbitrary memory corruption and potential privilege escalation.\nA:H - The use-after-free and double-free reliably corrupt kernel heap state and commonly cause BUG/KASAN faults, oops, or panic when the dangling list is traversed again, producing system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:18.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8a8d350a273c005a48c64c4519d21b2a51c5ceb"
        },
        {
          "url": "https://git.kernel.org/stable/c/506e635aed05dbdeef11e3c59f6e42980cda5b6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/838b57b3e7ce8cce0fda56d0861add3d464dd6c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/96ac562a9ea3020981f536384711190841c81aa8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e33a3bd5cb8d0cf1557dee014115f812c9686130"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa5655da368d0306c03e9dc9cda8ae2a7840926"
        }
      ],
      "title": "drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72449",
    "datePublished": "2026-08-15T05:56:58.313Z",
    "dateReserved": "2026-08-09T03:40:39.931Z",
    "dateUpdated": "2026-08-17T05:44:18.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72449",
      "date": "2026-09-21",
      "epss": "0.00171",
      "percentile": "0.06816"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c8a8d350a273c005a48c64c4519d21b2a51c5ceb",
                    "status": "affected",
                    "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "506e635aed05dbdeef11e3c59f6e42980cda5b6d",
                    "status": "affected",
                    "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "838b57b3e7ce8cce0fda56d0861add3d464dd6c8",
                    "status": "affected",
                    "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96ac562a9ea3020981f536384711190841c81aa8",
                    "status": "affected",
                    "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e33a3bd5cb8d0cf1557dee014115f812c9686130",
                    "status": "affected",
                    "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8fa5655da368d0306c03e9dc9cda8ae2a7840926",
                    "status": "affected",
                    "version": "2a909ae718715b3bac75d945e38dc0a5e4a0f1ba",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix list_del corruption in kfd_criu_resume_svm\n\nThe cleanup tail of kfd_criu_resume_svm() walks\nsvms-\u003ecriu_svm_metadata_list and kfree()s each struct criu_svm_metadata\nwithout removing it from the list. The list head is left pointing at\nfreed kmalloc-96 objects.\n\nA second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty()\nreads the dangling -\u003enext (use-after-free), the loop walks freed entries,\nand each is kfree()\u0027d again (double-free). This is reachable by an\nunprivileged render-group user via /dev/kfd with no capabilities required.\n\nAdd list_del() before the kfree() so the list is properly emptied. The\nlist_for_each_entry_safe() iterator already caches the next pointer, so\nunlinking during the walk is safe.\n\n(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)"
          }
        ],
        "id": "CVE-2026-72449",
        "lastModified": "2026-08-17T06:19:12.387",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:18.837",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/506e635aed05dbdeef11e3c59f6e42980cda5b6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/838b57b3e7ce8cce0fda56d0861add3d464dd6c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8fa5655da368d0306c03e9dc9cda8ae2a7840926"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/96ac562a9ea3020981f536384711190841c81aa8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c8a8d350a273c005a48c64c4519d21b2a51c5ceb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e33a3bd5cb8d0cf1557dee014115f812c9686130"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-19T17:25:22+00:00",
      "cve": "CVE-2026-72449",
      "id": "CVE-2026-72449",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "28",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72449.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-10T02:06:00Z",
      "cve": "CVE-2026-72449",
      "id": "CVE-2026-72449",
      "initial_release_date": "2026-09-02T11:45:20Z",
      "product_status:known_affected": "84",
      "product_status:known_not_affected": "278",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72449",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72449.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.