CVE-2026-89807

A flaw was found in the Linux kernel's drm/amdkfd component. A local user with CAP_CHECKPOINT_RESTORE capabilities could trigger a kernel NULL pointer dereference by issuing a crafted queue restore object during a CRIU (Checkpoint/Restore in User-space) operation. This vulnerability could lead to a system panic, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because successful exploitation requires local access with elevated privileges—specifically the CAP_CHECKPOINT_RESTORE capability—on systems equipped with AMD graphics hardware, limiting the blast radius to a localized denial of service. In standard Red Hat Enterprise Linux deployments, unprivileged users do not possess checkpoint and restore capabilities, preventing general accounts from invoking the vulnerable recovery routine. Consequently, system availability is only at risk if a malicious or compromised actor has already obtained these specialized process inspection privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.