CVE-2026-63882

A flaw was found in the AMD KFD (Kernel Fusion Driver) component of the Linux kernel. A local user could trigger a null pointer dereference in the svm_range_set_attr function by not calling kfd_ioctl_acquire_vm before kfd_ioctl_svm. This could lead to a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires an authenticated local user with direct access to the AMD GPU compute interface, limiting the blast radius to a denial of service (system crash) rather than code execution or privilege escalation. Systems lacking AMD graphics hardware or compute capabilities do not initialize the affected driver subsystem and are not exposed. In typical enterprise server deployments, unprivileged users do not have direct access to GPU device nodes, significantly restricting the practical attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.