drm/amdkfd: Unwind debug trap enable on copy_to_user failure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.158, 6.12.111, 6.18.53
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's AMD GPU compute driver (amdkfd, part of the DRM graphics subsystem) is affected. When enabling the debug trap fails while copying runtime information back to user space, the driver leaves the trap partly enabled, which can leave its state inconsistent and its reference counts unbalanced, potentially causing later debug disable or enable requests to malfunction.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE. On copy_to_user failure, deactivate the trap and undo the rest of the enable setup before returning.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Linux Linux
From 0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508 · fixed in 641be20110cdfb6d921605adb42a764a0fccac54; From 0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508 · fixed in 656a40bdc20def58790b8512e6000195436d8855; From 0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508 · fixed in 1b39f46eec2f907417d4955bb88434170f94a8d8; From 0ab2d7532b05a3e7c06fd3b0c8bd6b46c1dfb508 · fixed in 01112e241e37f9ac98b6f418d93ce2e0b87b7ee0
- Linux Linux
6.5
- KernelLinux
fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53