CVE-2026-89807

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/amdkfd component where the functions create queue cpsch() and create queue nocpsch() call mqd mgr->restore mqd() during a CRIU restore process without verifying if the callback is implemented. A user with CAP CHECKPOINT RESTORE privileges can trigger a kernel NULL pointer dereference—a condition where the system attempts to read a memory address that is null—leading to a system panic. This is achieved by issuing the KFD IOC CRIU OP RESTORE endpoint with a specially crafted queue restore object. On GFX12 systems, this path can only be reached via a hand-crafted restore payload as checkpoint mqd is unimplemented.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.