CVE-2026-72449 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects.
A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required.
Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe.
(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's AMD Kernel Features Daemon implementation within the drm/amdkfd subsystem, specifically affecting the kfd_criu_resume_svm function. This flaw represents a classic use-after-free condition that can be exploited by unprivileged users with access to the /dev/kfd device node. The issue occurs during the cleanup phase of the CRIU (Checkpoint/Restore in Userspace) operation when the kernel attempts to process a list of svm metadata structures. The function walks through svms->criu_svm_metadata_list without properly removing entries from the list before freeing them, leaving the list head pointing to freed memory locations that were allocated with kmalloc-96.
The technical execution of this vulnerability follows a predictable pattern that leads to memory corruption and potential privilege escalation. When a second AMDKFD_IOC_CRIU_OP ioctl call is issued from the same process, the list_empty() function attempts to read the dangling next pointer of previously freed structures, resulting in use-after-free conditions. The subsequent loop continues to traverse these freed entries, causing each to be kfree()'d multiple times, which constitutes a double-free vulnerability. This particular flaw leverages the render-group user permissions and requires no special capabilities, making it particularly dangerous as it can be exploited by any user with access to the graphics subsystem through /dev/kfd.
The operational impact of this vulnerability extends beyond simple memory corruption, as it creates opportunities for arbitrary code execution and system instability. The double-free condition can be leveraged to corrupt kernel memory structures, potentially allowing attackers to manipulate the kernel's heap management or redirect execution flow. This vulnerability directly maps to CWE-415: Double Free and CWE-416: Use After Free, both of which are classified as critical severity issues in the Common Weakness Enumeration catalog. The ATT&CK framework would categorize this under T1068: Exploitation for Privilege Escalation and T1059: Command and Scripting Interpreter, as it enables unprivileged users to gain elevated privileges through kernel memory corruption.
The fix implemented addresses the root cause by ensuring proper list management during the cleanup process. The solution involves adding list_del() calls before each kfree() operation within the kfd_criu_resume_svm function, which ensures that list entries are properly removed from the linked list structure before being freed. This approach utilizes the existing list_for_each_entry_safe() iterator mechanism, which already caches the next pointer during iteration, making it safe to unlink elements while traversing the list. The fix prevents both the dangling pointer references and subsequent double-free conditions, maintaining kernel memory integrity and preventing potential exploitation by malicious users. The solution follows established kernel development practices for list management and demonstrates proper resource cleanup techniques that should be applied whenever manipulating linked data structures in kernel space.