What happened
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy_queue_cpsch wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.
Affected versions
Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 41144829f4645c2bd4cb501d34d253858f750c0a (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before d98c8032c29944e1e572e1f49a0613d364fece0f (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before ac081deaf16a639ea7dff2f285fe421a33c1ade0 (git); before 6.12.111 (semver); before 6.18.53 (semver) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.