Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72449— drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

CVSS 7.8 · High EPSS 0.17% · P7

Affected Version Matrix 14

VendorProductVersion RangeStatus
LinuxLinux2a909ae718715b3bac75d945e38dc0a5e4a0f1ba< c8a8d350a273c005a48c64c4519d21b2a51c5cebaffected
2a909ae718715b3bac75d945e38dc0a5e4a0f1ba< 506e635aed05dbdeef11e3c59f6e42980cda5b6daffected
2a909ae718715b3bac75d945e38dc0a5e4a0f1ba< 838b57b3e7ce8cce0fda56d0861add3d464dd6c8affected
2a909ae718715b3bac75d945e38dc0a5e4a0f1ba< 96ac562a9ea3020981f536384711190841c81aa8affected
2a909ae718715b3bac75d945e38dc0a5e4a0f1ba< e33a3bd5cb8d0cf1557dee014115f812c9686130affected
2a909ae718715b3bac75d945e38dc0a5e4a0f1ba< 8fa5655da368d0306c03e9dc9cda8ae2a7840926affected
5.18affected
< 5.18unaffected
… +6 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-72449

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. (cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 2a909ae718715b3bac75d945e38dc0a5e4a0f1ba ~ c8a8d350a273c005a48c64c4519d21b2a51c5ceb -
LinuxLinux 5.18 -

II. Public POCs for CVE-2026-72449

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72449

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72449 (6)

Same Patch Batch · Linux · 2026-08-15 · 846 CVEs total

CVE-2026-7428010.0 CRITICALcrypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-7427910.0 CRITICALcrypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-7240710.0 CRITICALgeneve: validate inner network offset in geneve_gro_complete()
CVE-2026-7240810.0 CRITICALgeneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-7430910.0 CRITICALvdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-7447510.0 CRITICALvxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-7242110.0 CRITICALipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-724939.9 CRITICALnet: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-724639.8 CRITICALxfrm: Fix dev use-after-free in xfrm async resumption
CVE-2026-722489.8 CRITICALnetfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-723819.8 CRITICALksmbd: fix use-after-free of fp->owner.name in durable handle owner check
CVE-2026-724779.8 CRITICALfs/ntfs3: call _ntfs_bad_inode() when failing to rename
CVE-2026-724739.8 CRITICALxprtrdma: Decouple req recycling from RPC completion
CVE-2026-724729.8 CRITICALnfs: use nfsi->rwsem to protect traversal of the file lock list
CVE-2026-744069.8 CRITICALvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
CVE-2026-722229.8 CRITICALsunrpc: pin svc_xprt across the asynchronous TLS handshake callback
CVE-2026-721379.8 CRITICALxfrm: nat_keepalive: avoid double free on send error
CVE-2026-743769.8 CRITICALmd/raid10: reset read_slot when reusing r10bio for discard
CVE-2026-722269.8 CRITICALbatman-adv: tt: prevent TVLV OOB check overflow
CVE-2026-722349.8 CRITICALbatman-adv: access unicast_ttvn skb->data only after skb realloc

Showing top 20 of 846 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72449

No comments yet

Leave a comment