drm/amdkfd: fix NULL dereference in get_queue_ids()
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
||||||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux Kernel |
|
||||||||||||||||||||||||||||||||
| Linux | Linux Kernel |
|
| Source | ID | Title |
|---|---|---|
Ubuntu USN |
USN-8726-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8727-1 | Linux kernel (OEM) vulnerabilities |
Ubuntu USN |
USN-8728-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8760-1 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8726-2 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-8726-3 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-8800-1 | Linux kernel (NVIDIA BaseOS) vulnerabilities |
Ubuntu USN |
USN-8760-2 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8726-4 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8728-2 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8728-3 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-8903-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8904-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8905-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8906-1 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-8903-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8905-2 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-9002-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
Ubuntu USN |
USN-9025-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9066-1 | Linux kernel (HWE) vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.122% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-476 |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL dereference in get_queue_ids() When usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() returns NULL. The callers check only IS_ERR() on the return value; since IS_ERR(NULL) == false the check passes, and suspend_queues() calls q_array_invalidate() which immediately dereferences NULL while iterating num_queues times. Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying num_queues > 0 with a zero queue_array_ptr, causing a kernel panic. A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op (q_array_invalidate never executes, and resume_queues already guards all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL) only when num_queues is non-zero and the pointer is absent; both callers already propagate IS_ERR() returns correctly to userspace. (cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4) | |
| Title | drm/amdkfd: fix NULL dereference in get_queue_ids() | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|