CVE-2026-80870 - Vulnerability Details

- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

The KFD CRIU restore flow restores previously saved object IDs from
userspace.

For event restore:

kfd_criu_restore_event()
-> create_signal_event() / create_other_event()
-> allocate_event_notification_slot()
-> idr_alloc(..., *restore_id, *restore_id + 1, ...)

For BO restore:

criu_restore_memory_of_gpu()
-> idr_alloc(..., bo_priv->idr_handle, ...)

In both cases, the restored ID comes from userspace-provided CRIU data.

idr_alloc() expects the ID range values to fit within signed int
limits. If a restored ID is larger than INT_MAX, it can trigger a WARN
in the IDR layer.

A kernel WARN is undesirable because it prints a warning trace and may
cause a panic or reboot on systems with panic_on_warn enabled.

Smatch reported these paths as allowing unchecked userspace values to
reach idr_alloc().

Add INT_MAX validation before using restored IDs in:

- kfd_criu_restore_event()
- criu_restore_memory_of_gpu()

If the restored ID is invalid, return -EINVAL.

This prevents invalid restore data from reaching the IDR layer and
avoids WARN-triggering paths, while keeping valid restore behavior
unchanged.

Published: 2026-09-04

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises when the Linux kernel restores object IDs from userspace CRIU data without verifying that those IDs fall within the signed 32‑bit integer range. If a restored ID exceeds INT_MAX, the IDR allocation routine emits a WARN. Depending on system configuration, such a WARN can trigger a panic or reboot. This flaw does not directly allow arbitrary code execution but can lead to denial of service by destabilizing the kernel.

Affected Systems

All impacted systems run the Linux kernel where the KFD DRM driver is active, specifically those using the amdkfd component to support GPU devices. The vulnerability is present in kernel versions that have not applied the following fix: validation of CRIU‑restored IDs before calling idr_alloc, added in commit 085ea93bda71fee600cc12a17026598eb10dd1f9. Users of newer kernels containing the updated code are unaffected.

Risk and Exploitability

The CVSS score for this issue is not provided in the available data, but the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, indicating limited evidence of exploitation. The attack vector is local: an attacker with the ability to control CRIU restore data can supply large IDs to trigger the kernel WARN path. Because the flaw leads to a potential panic, the damage can be immediate but mitigated through patching or disabling CRIU restore functionality. The risk level is moderate to high for environments that permit CRIU restoration of GPU resources.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`40e8a766a761f7fdc8530347527b344fddf6f1a8`	affected	< f8687018f24037056692c1e93c7d96cc72889d5b
`40e8a766a761f7fdc8530347527b344fddf6f1a8`	affected	< 89a75e3349c4fae28cbedc711bc924cbc6293da2
`40e8a766a761f7fdc8530347527b344fddf6f1a8`	affected	< 085ea93bda71fee600cc12a17026598eb10dd1f9
`40e8a766a761f7fdc8530347527b344fddf6f1a8`	affected	< 543ed0f61d56501cc585162da600bbedd7c08c0f
`40e8a766a761f7fdc8530347527b344fddf6f1a8`	affected	< cb6311f25a096621ac7ffd91b50d1bb1cfb63a96
`40e8a766a761f7fdc8530347527b344fddf6f1a8`	affected	< 85043dd49c2f51a37b22618168e3ae59ab92f0d6

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[40e8a766a761f7fdc8530347527b344fddf6f1a8,f8687018f24037056692c1e93c7d96cc72889d5b)`	affected	code_commit	—
`[40e8a766a761f7fdc8530347527b344fddf6f1a8,89a75e3349c4fae28cbedc711bc924cbc6293da2)`	affected	code_commit	—
`[40e8a766a761f7fdc8530347527b344fddf6f1a8,085ea93bda71fee600cc12a17026598eb10dd1f9)`	affected	code_commit	—
`[40e8a766a761f7fdc8530347527b344fddf6f1a8,543ed0f61d56501cc585162da600bbedd7c08c0f)`	affected	code_commit	—
`[40e8a766a761f7fdc8530347527b344fddf6f1a8,cb6311f25a096621ac7ffd91b50d1bb1cfb63a96)`	affected	code_commit	—
`[40e8a766a761f7fdc8530347527b344fddf6f1a8,85043dd49c2f51a37b22618168e3ae59ab92f0d6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	generic	—
`[0,5.18)`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a Linux kernel version that incorporates the idr_alloc input‑validation patch; the change is committed in the repository update referenced above.
If a kernel update is not immediately possible, limit CRIU restore usage to trusted users or disable the restoration of GPU objects entirely until a patch is applied.
Implement kernel log monitoring to detect WARN messages from idr_alloc and investigate any abnormal kernel restarts promptly.

Generated by OpenCVE AI on September 4, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/085ea93bda71fee600cc12a17026598eb10dd1f9
https://git.kernel.org/stable/c/543ed0f61d56501cc585162da600bbedd7c08c0f
https://git.kernel.org/stable/c/85043dd49c2f51a37b22618168e3ae59ab92f0d6
https://git.kernel.org/stable/c/89a75e3349c4fae28cbedc711bc924cbc6293da2
https://git.kernel.org/stable/c/cb6311f25a096621ac7ffd91b50d1bb1cfb63a96
https://git.kernel.org/stable/c/f8687018f24037056692c1e93c7d96cc72889d5b

History

Fri, 04 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 04 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., restore_id, restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.
Title		drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/085ea93bda71fee600cc12a17026598eb10dd1f9 https://git.kernel.org/stable/c/543ed0f61d56501cc585162da600bbedd7c08c0f https://git.kernel.org/stable/c/85043dd49c2f51a37b22618168e3ae59ab92f0d6 https://git.kernel.org/stable/c/89a75e3349c4fae28cbedc711bc924cbc6293da2 https://git.kernel.org/stable/c/cb6311f25a096621ac7ffd91b50d1bb1cfb63a96 https://git.kernel.org/stable/c/f8687018f24037056692c1e93c7d96cc72889d5b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T16:48:31.902Z

Updated: 2026-09-04T16:48:31.902Z

Reserved: 2026-08-26T14:34:25.798Z

Link: CVE-2026-80870

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T17:16:58.860

Modified: 2026-09-04T17:16:58.860

Link: CVE-2026-80870

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T23:30:06Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object