{"id":"CVE-2026-98905","kind":"vulnerability","aliases":["CVE-2026-98905"],"related":[],"title":"Linux kernel: AMD KFD checkpoint restore leaves queue buffers unset","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Properly acquire queue buffers in CRIU restore\n\nWhen kfd_queue_acquire_buffers() was split off from\nset_queue_properties_from_user(), set_queue_properties_from_criu()\nwas missed. Thus, set_queue_properties_from_criu() is not\nfilling out the buffer fields of queue_properties, which\ncan come up when subsequent code expects them to be non-null.\n\nAdd the proper call to kfd_queue_acquire_buffers(), and also\nuse the right cast types in set_queue_properties_from_criu()\n(which were missed at the same time)\n\n(cherry picked from commit 88ed96abbbe27b70193544fbc1ee06448c274714)","summary":"In the Linux kernel's AMD GPU compute driver (amdkfd), the CRIU checkpoint-restore path never fills in the buffer fields of a queue's properties, so later code can dereference null pointers. The sources do not describe an attacker-facing effect beyond this kernel crash risk.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-gpu","infrastructure","kernel","linux"],"not_affected_if":["no-amd-gpu"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:34+00:00","updated_at":"2026-10-25T04:58:34+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:58:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: AMD KFD checkpoint restore leaves queue buffers unset","impact":"medium","summary":"In the Linux kernel's AMD GPU compute driver (amdkfd), the CRIU checkpoint-restore path never fills in the buffer fields of a queue's properties, so later code can dereference null pointers. The sources do not describe an attacker-facing effect beyond this kernel crash risk.","category":"infrastructure","nicknames":[],"who_cares":["linux","amd-gpu","kernel"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit 88ed96abbbe2 for affected kernel version ranges and the exact crash or exploit impact.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-amd-gpu"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000537,"input_tokens":3469,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98905':13A,16A '88ed96abbbe27b70193544fbc1ee06448c274714':174C 'acquir':84C,93C,148C 'add':141C 'also':151C 'amd':3A,18B,28B 'amd-gpu':17B 'amdkfd':32B 'attack':64B 'attacker-fac':63B 'beyond':67B 'buffer':9A,43B,86C,94C,122C,149C 'call':144C 'cast':155C 'checkpoint':5A,36B 'checkpoint-restor':35B 'cherri':170C 'code':52B,133C 'come':129C 'commit':173C 'comput':30B 'crash':70B 'criu':34B,88C,108C,116C,162C 'cve':11A,14A 'derefer':54B 'describ':61B 'driver':31B 'drm/amdkfd':82C 'effect':66B 'expect':134C 'face':65B 'field':44B,123C 'fill':40B,119C 'follow':77C 'gpu':19B,29B 'infrastructur':20B 'kernel':2A,21B,26B,69B,75C 'kfd':4A,91C,146C 'later':51B 'leav':7A 'linux':1A,22B,25B,74C 'miss':110C,165C 'never':39B 'non':139C 'non-nul':138C 'null':55B,140C 'path':38B 'pick':171C 'pointer':56B 'proper':83C,143C 'properti':49B,101C,106C,114C,126C,160C 'queue':8A,47B,85C,92C,100C,105C,113C,125C,147C,159C 'resolv':81C 'restor':6A,37B,89C 'right':154C 'risk':71B 'set':99C,104C,112C,158C 'sourc':58B 'split':96C 'subsequ':132C 'thus':111C 'time':169C 'type':156C 'unset':10A 'use':152C 'user':103C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98905","severity":null,"published_at":"2026-10-23T12:18:24+00:00","modified_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}