CVE-2026-80870
kernel: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 4, 2026
Updated · October 30, 2026
Description
A flaw was found in the Linux kernel's drm/amdkfd component. A local user could provide a specially crafted ID during the Checkpoint/Restore in Userspace (CRIU) restore process. If this restored ID is larger than the maximum integer value (INT_MAX), it can trigger a kernel warning. This warning may lead to a system panic or reboot, resulting in a denial of service.
Statement
This vulnerability is rated as having a Low impact for Red Hat Enterprise Linux because triggering a kernel warning requires local privileges to initiate a CRIU restore operation on an AMD GPU device, and standard default configurations do not crash upon encountering a warning. Under standard deployments, systems run with panic-on-warn disabled, meaning the condition merely produces diagnostic logging rather than halting the host. Furthermore, systems lacking AMD graphics hardware or those not utilizing process checkpoint/restore workflows with KFD are not exposed to this issue.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 · Integer Overflow or Wraparound