CVE-2026-72449

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged render-group user can exploit this vulnerability via /dev/kfd by repeatedly calling AMDKFD_IOC_CRIU_OP. This leads to a use-after-free and double-free condition due to improper list handling during cleanup. Successful exploitation can result in memory corruption, potentially allowing for arbitrary code execution or a denial of service.

This vulnerability is rated as Important because a local user with access to the AMD KFD device node can trigger kernel memory corruption through use-after-free and double-free conditions, potentially achieving local privilege escalation or inducing a complete system crash. Exploitation requires local access to /dev/kfd, which by default is restricted to members of the render or video groups on hosts featuring AMD GPU hardware. Environments without AMD graphics hardware or systems where unprivileged accounts do not have access to GPU device nodes are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.