CVE-2026-80870

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Validate CRIU-restored IDs before idr alloc

The KFD CRIU restore flow restores previously saved object IDs from userspace.

For event restore:

kfd criu restore event() -> create signal event() / create other event() -> allocate event notification slot() -> idr alloc(..., *restore id, *restore id + 1, ...)

For BO restore:

criu restore memory of gpu() -> idr alloc(..., bo priv->idr handle, ...)

In both cases, the restored ID comes from userspace-provided CRIU data.

idr alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT MAX, it can trigger a WARN in the IDR layer.

A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic on warn enabled.

Smatch reported these paths as allowing unchecked userspace values to reach idr alloc().

Add INT MAX validation before using restored IDs in:

If the restored ID is invalid, return -EINVAL.

This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.