An incorrect SDMA queue checkpoint/restore implementation in the amdkfd driver on GFX11 kernels caused a 1536‑byte buffer overflow because functions used the larger compute_mqd size instead of the 512‑byte sdma_mqd size. The overflow allows an attacker to read 1536 bytes of adjacent GTT memory during a CRIU checkpoint, leaking kernel data to userspace, and to write 1536 bytes during a CRIU restore, corrupting neighboring GTT memory such as the ring buffer or other MQDs. The resulting write or read can compromise the confidentiality, integrity, and availability of kernel state, enabling local privilege escalation or denial of service.

All Linux kernels that contain the amdkfd driver for GFX11 (Navi3x) hardware are affected. The vulnerability exists prior to the kernel patch that fixes the SDMA checkpoint/restore logic; any distribution using an older unsupported kernel version that includes the unpatched amdkfd driver is at risk.

The flaw is a classic buffer overflow (CWE-122/CWE-787) that can be triggered by a local process that initiates a CRIU checkpoint or restore of an SDMA queue. No EPSS score is available, but the severity is high due to kernel memory corruption. The vulnerability is not listed in the CISA KEV catalog, yet its local attack vector combined with kernel privilege escalation potential makes it a critical issue for systems that expose amdkfd or use CRIU with SDMA queues.