CVE-2026-80870

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

EUVD-2026-71500

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80870

CVE-2026-80870 affects the Linux kernel component drm/amdkfd (AMD Kernel Fusion Driver). The vulnerability exists in the CRIU restore flow, where userspace-provided object IDs are passed to idr_alloc() without validation in kfd_criu_restore_event() and criu_restore_memory_of_gpu() . If a restored...

CVE-2026-80870

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

PT-2026-85789

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KFD CRIU restore flow where object IDs restored from userspace are not properly validated before being passed to the idr alloc function. Specifically, in the kfd...

CVE-2026-80870: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

SUSE CVE-2026-72449

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

PT-2026-110905

Name of the Vulnerable Software and Affected Versions containerd versions 2.1.0 through 2.2.6 containerd versions 2.3.0 through 2.3.3 Description The CRI CreateContainer checkpoint restore process in containerd is flawed because CRIU Checkpoint/Restore In Userspace restores the process security...

Important: criu

Issue Overview: A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials sav...

Amazon Linux 2023 : crit, criu, criu-devel (ALAS2023-2026-2126)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2126 advisory. A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite co...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on the CRIU restore queue type and mqdsize. We were not checking whether the values provided in the private data of the kfd CRIU restore were within bounds. For the queue type, add a const value...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Holding eventmutex during checkpointing CRIU events The function kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents. It allocates an array sized to that count, and then iterates over the same...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check the bounds when allocating an eventnotificationslot. Valid event IDs range from 0 to KFDSIGNALEVENTLIMIT. The allocateeventnotificationslot function has an option to specify an event ID to allocate; this option ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed the corruption in the listdel operation in kfdcriuresumesvm. The cleanup code for kfdcriuresumesvm iterates through svms-criusvmmetadatalist and calls kfree on each struct criusvmmetadata. However, this does not...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clamp the BO size of the CRIU control stack checkpoint copy. CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from the hardware, without bounding it to the allocated BO region. If the HW field is...

SUSE CVE-2026-68258

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

SUSE CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU Checkpoint/Restore in User-space operations on SDMA System Direct Memory Access queues. A local attacker can exploit this fl...