The Linux kernel’s AMD Kernel Fusion Driver (amdkfd) suffers a use‑after‑free and double‑free flaw in the kfd_criu_resume_svm function. When a process performs the second CRIU ioctl, the code walks a list of metadata structures, frees each without unlinking it, and leaves the list head pointing at freed memory. A subsequent call re‑enters the list, reads the dangling next pointers, and frees the same objects again, corrupting kernel memory. Attackers can exploit this through /dev/kfd without needing elevated privileges, potentially allowing them to execute arbitrary code in kernel mode or elevate their privileges from a regular user account.

All Linux kernel installations that ship the unpatched AMD Kernel Fusion Driver. Any kernel version containing the older amdkfd implementation before the commit that adds list_del in the cleanup code is affected. No specific version numbers are listed, so all kernels that have not incorporated the fix may be vulnerable.

A local user can trigger the error by issuing the vulnerable ioctl sequence on /dev/kfd, so the attack does not require special capabilities. The flaw results in kernel memory corruption, making the risk of local privilege escalation or arbitrary code execution high. With a CVSS score of 7.8, the vulnerability is rated as high severity. An EPSS score of less than 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the lack of a protection mechanism and the ability to be triggered by an unprivileged process make the threat substantial.