CVE-2026-53144

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix NULL dereference in get_queue_ids()

When usr_queue_id_array is NULL and num_queues is non-zero,

get_queue_ids() returns NULL. The callers check only IS_ERR() on the

return value; since IS_ERR(NULL) == false the check passes, and

suspend_queues() calls q_array_invalidate() which immediately

dereferences NULL while iterating num_queues times.

Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying

num_queues > 0 with a zero queue_array_ptr, causing a kernel panic.

A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op

(q_array_invalidate never executes, and resume_queues already guards

all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL)

only when num_queues is non-zero and the pointer is absent; both callers

already propagate IS_ERR() returns correctly to userspace.

(cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References