CVE-2026-89809 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr.
The queue list can contain entries where pqn->q is NULL (kernel queues where only pqn->kq is valid). In the original code:
if (pqn->q) {
... mqd_mgr = q->device->dqm->mqd_mgrs[mqd_type];
size = mqd_mgr->mqd_stride(...); }
for (xcc = 0; xcc < num_xccs; xcc++) { // WRONG: outside if block
mqd = q->mqd + size * xcc; r = mqd_mgr->debugfs_show_mqd(m, mqd); }
When iterating over a queue node where pqn->q is NULL: 1. The if (pqn->q) block is skipped 2. mqd_mgr remains uninitialized (NULL from declaration) 3. The for loop executes anyway 4. mqd_mgr->debugfs_show_mqd(m, mqd) dereferences NULL
The crash manifests as:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode RIP: 0010:0x0 Call Trace: pqm_debugfs_mqds+0x10c/0x1d0 [amdgpu]
kfd_debugfs_mqds_by_process+0x9b/0x110 [amdgpu]
seq_read_iter+0x132/0x4b0 ...
Fix by moving the for loop inside the if (pqn->q) block, so mqd_mgr and related variables are only used when properly initialized.
(cherry picked from commit 8bfe29d5c798940f797aa24135d2734c3ffce9de)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's DRM AMD KFD subsystem represents a critical logic error within the debugfs interface, specifically affecting the pqm_debugfs_mqds function. This flaw arises from an incorrect structural placement of a loop that iterates over hardware compute units relative to a conditional check for queue validity. The root cause is a scope mismanagement where the initialization and validation of the mqd_mgr pointer are confined within an if block checking for the existence of pqn->q, while the subsequent iteration logic remains outside this protective boundary. This architectural oversight allows the code path to proceed with uninitialized or null pointers when processing kernel queues that do not possess user-space queue structures.
From a technical perspective, the defect manifests as a NULL pointer dereference triggered by reading from /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue. The Linux kernel's debugfs interface is designed for diagnostic purposes and typically requires root privileges to access. However, the vulnerability allows a local attacker with appropriate permissions to trigger a crash in the kernel space. When the code encounters a queue node where pqn->q is NULL, which corresponds to internal kernel queues where only pqn->kq is valid, the conditional block initializing mqd_mgr is skipped. Consequently, mqd_mgr retains its initial null value from declaration. The subsequent for loop then executes regardless of this state, attempting to call mqd_mgr->debugfs_show_mqd with a NULL pointer. This results in a supervisor instruction fetch fault at address zero, leading to an immediate kernel panic or BUG: kernel NULL pointer dereference event as indicated by the provided crash trace.
The operational impact of this vulnerability is primarily centered on system stability and availability rather than direct data exfiltration or privilege escalation. A successful exploitation leads to a Denial of Service condition where the affected Linux instance crashes, requiring a reboot to restore service. While debugfs interfaces are generally restricted, if accessible by unprivileged users in certain configurations or through misconfigurations that expose kernel debugging symbols and files, this vulnerability could be leveraged for local denial-of-service attacks. The crash trace confirms the failure occurs within the amdgpu driver module during the processing of queue management data structures, highlighting the importance of robust error handling even in diagnostic code paths intended for developers rather than end-users.
This issue aligns with CWE-476, which describes a NULL Pointer Dereference vulnerability where software incorrectly handles pointers that are null, leading to crashes or unexpected behavior. In terms of threat modeling and attack patterns, this scenario relates to the ATT&CK technique T1053 Scheduled Task/Job, specifically when considering how local services might be disrupted, although more accurately it fits under general system availability impacts rather than a specific execution framework. The vulnerability underscores the necessity for rigorous code review practices regarding variable scope and initialization sequences in kernel development.
To mitigate this risk, the primary remediation involves refactoring the pqm_debugfs_mqds function to ensure that all operations dependent on mqd_mgr are strictly contained within the conditional block where pqn->q is verified as non-null. By moving the for loop inside the if (pqn->q) block, developers guarantee that mqd_mgr and related variables are only accessed when they have been properly initialized with valid device data structure pointers. This structural correction prevents the execution of code paths against invalid queue nodes. Administrators should apply the corresponding kernel patch or update to their systems as soon as possible. Additionally, organizations should review access controls for debugfs interfaces to ensure that such diagnostic tools are not exposed to untrusted users, thereby reducing the attack surface even if similar logical flaws exist in other parts of the driver stack.