CVE-2025-21842

In the Linux kernel, the following vulnerability has been resolved:

amdkfd: properly free gang_ctx_bo when failed to init user queue

The destructor of a gtt bo is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void mem_obj); Which takes void as the second parameter.

GCC allows passing void* to the function because void* can be implicitly casted to any other types, so it can pass compiling.

However, passing this void* parameter into the function's execution process(which expects void** and dereferencing void**) will result in errors.

A flaw of low impact was found in the Linux kernel AMD KFD (amdkfd) compute driver. When initialization of a user queue fails, the error path in drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c frees the gang context buffer object (gang_ctx_bo) by passing a single-level pointer to the amdgpu_amdkfd_free_gtt_mem() destructor, which expects a pointer to a pointer (void **) and dereferences its second argument. Due to this mismatched argument, the failure cleanup does not correctly release the buffer object and results in errors. Triggering the flaw requires local access with high privileges, and the consequence is limited to system availability (Red Hat CVSS 4.4, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). The CVE.org record assigns a generic score of 7.8 with high confidentiality and integrity impacts, which differs from the Red Hat assessment because the issue is confined to an error-handling path of the amdkfd driver and does not affect confidentiality or integrity. The vulnerable code, introduced in the upstream Linux 6.12 kernel, is not present in the shipped Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS kernels, so all currently listed Red Hat product streams are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.