CVE-2026-80870

Summary

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

The KFD CRIU restore flow restores previously saved object IDs from userspace.

For event restore:

kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(…, *restore_id, *restore_id + 1, …)

For BO restore:

criu_restore_memory_of_gpu() -> idr_alloc(…, bo_priv->idr_handle, …)

In both cases, the restored ID comes from userspace-provided CRIU data.

idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer.

A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled.

Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc().

Add INT_MAX validation before using restored IDs in:

• kfd_criu_restore_event()
• criu_restore_memory_of_gpu()

If the restored ID is invalid, return -EINVAL.

This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.

Affected Software

Weaknesses

References

• https://git.kernel.org/stable/c/f8687018f24037056692c1e93c7d96cc72889d5b
• https://git.kernel.org/stable/c/89a75e3349c4fae28cbedc711bc924cbc6293da2
• https://git.kernel.org/stable/c/085ea93bda71fee600cc12a17026598eb10dd1f9
• https://git.kernel.org/stable/c/543ed0f61d56501cc585162da600bbedd7c08c0f
• https://git.kernel.org/stable/c/cb6311f25a096621ac7ffd91b50d1bb1cfb63a96
• https://git.kernel.org/stable/c/85043dd49c2f51a37b22618168e3ae59ab92f0d6

• ←Previous
• Next→