CVE-2026-80870

Dashboard / Vulnerabilities / CVE-2026-80870

CVE-2026-80870

Summary: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

Details: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfd_criu_restore_event() -> create_signal_event() / create_other_event() -> allocate_event_notification_slot() -> idr_alloc(..., *restore_id, *restore_id + 1, ...) For BO restore: criu_restore_memory_of_gpu() -> idr_alloc(..., bo_priv->idr_handle, ...) In both cases, the restored ID comes from userspace-provided CRIU data. idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer. A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled. Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc(). Add INT_MAX validation before using restored IDs in: - kfd_criu_restore_event() - criu_restore_memory_of_gpu() If the restored ID is invalid, return -EINVAL. This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.

References: https://git.kernel.org/stable/c/085ea93bda71fee600cc12a17026598eb10dd1f9, https://git.kernel.org/stable/c/543ed0f61d56501cc585162da600bbedd7c08c0f, https://git.kernel.org/stable/c/85043dd49c2f51a37b22618168e3ae59ab92f0d6, https://git.kernel.org/stable/c/89a75e3349c4fae28cbedc711bc924cbc6293da2, https://git.kernel.org/stable/c/cb6311f25a096621ac7ffd91b50d1bb1cfb63a96, https://git.kernel.org/stable/c/f8687018f24037056692c1e93c7d96cc72889d5b, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80870.json, https://nvd.nist.gov/vuln/detail/CVE-2026-80870, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git