In the Linux kernel, the amdkfd driver for GFX11 (Navi3x) contains a buffer overflow in the SDMA queue checkpoint/restore logic. The bug arose because the functions checkpoint_mqd and restore_mqd used the 2048-byte compute_mqd size instead of the correct 512-byte sdma_mqd size, causing a 1536-byte overflow. During a CRIU checkpoint, the driver reads 2048 bytes from a 512-byte buffer, leaking 1536 bytes of adjacent GTT memory; during restoration, it writes 2048 bytes, corrupting 1536 bytes of surrounding memory such as the ring buffer or neighboring MQDs. Based on the description, it is inferred that an attacker can read leaked kernel memory from userspace and overwrite critical GTT data when restoring, enabling confidentiality loss, integrity compromise, and potential denial of service.

Affected are Linux kernels that include the amdkfd driver for GFX11 (Navi3x) hardware. This includes kernel versions 7.1 rc1 through rc6 and earlier releases that had not yet incorporated the patch; any distribution using those kernels is at risk.

The likely attack vector is a local process that performs CRIU checkpoint or restore of an SDMA queue. Based on the description, it is inferred that the attacker must have local access to the affected kernel and may trigger the flaw via user-space software that interacts with KFD. The CVSS score of 7.8 indicates a high-severity vulnerability, while the EPSS score of < 1 % implies a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, yet its kernel privilege escalation potential makes it a critical issue for systems that expose amdkfd or run CRIU on GFX11 GPUs.