Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74448— drm/amdkfd: fix QID bit leak in pqm_create_queue()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6.151之前版本、6.12.103之前版本、6.18.44之前版本和7.1.8之前版本存在安全漏洞，该漏洞源于pqm_create_queue()函数错误处理不当，当MES启用且amdgpu_amdkfd_alloc_kernel_mem()失败时提前返回，未调用clear_bit，导致QID位泄漏，可能耗尽所有可用的队列槽。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 0f88894aa628680747ae27760e5f627f901a435f< 8924e2594a15bdbd07f8696770864366d787ab70 affected
c0ef1c8ef70bfa3487ea84f794d7a1f0fea0735d< 2ff5bb3645c72b3690e70c513a62a86600c4632f affected
fddc45026311c05a5355fd34b9dc0a1d7eaef4a2< 5f0f2ddeac738e2ca9d12cb76a1ff2904e85ecc3 affected
fddc45026311c05a5355fd34b9dc0a1d7eaef4a2< 7c35bf94150d872e670a6632aa819d320279effb affected
fddc45026311c05a5355fd34b9dc0a1d7eaef4a2< 38b73293f38658a4685ffcea666462024f858ad9 affected
9d61e2b81f5fc90c87975879809346e7c90ea5f9 affected
d86ba913bbfd1afafacbfb750001ffc6bfe29da0 affected
6.6.87< 6.6.151 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74448

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/amdkfd: fix QID bit leak in pqm_create_queue()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqm_create_queue() When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() returns early via 'return retval' without going through the err_create_queue cleanup label. This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called, leaving the reserved QID bit permanently set in queue_slot_bitmap. Over time this leaks QID slots, potentially exhausting all available queue slots. Fix this by replacing 'return retval' with 'goto err_allocate_pqn' so that clear_bit() is always called on the error path without touching the uninitialized pqn pointer. AILIKFD-813 (cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.6.151之前版本、6.12.103之前版本、6.18.44之前版本和7.1.8之前版本存在安全漏洞，该漏洞源于pqm_create_queue()函数错误处理不当，当MES启用且amdgpu_amdkfd_alloc_kernel_mem()失败时提前返回，未调用clear_bit，导致QID位泄漏，可能耗尽所有可用的队列槽。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0f88894aa628680747ae27760e5f627f901a435f ~ 8924e2594a15bdbd07f8696770864366d787ab70 -
Linux Linux 6.15 -

II. Public POCs for CVE-2026-74448

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74448

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74448 (5)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72319 9.8 CRITICAL ipvs: ensure inner headers in ICMP errors are in headroom
CVE-2026-72220 9.8 CRITICAL sunrpc: harden rq_procinfo lifecycle to prevent double-free
CVE-2026-72217 9.8 CRITICAL SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
CVE-2026-74384 9.8 CRITICAL nvme-multipath: fix flex array size in struct nvme_ns_head
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-72210 9.8 CRITICAL ntfs: fix off-by-one in mapping pairs decoding bounds checks
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72317 9.8 CRITICAL SUNRPC: pin upper rpc_clnt across the TLS connect_worker
CVE-2026-72209 9.8 CRITICAL ntfs: validate attribute values on lookup
CVE-2026-74268 9.8 CRITICAL tcp: clear sock_ops cb flags before force-closing a child socket
CVE-2026-72207 9.8 CRITICAL ntfs: not change 0-byte $DATA attribute to non-resident
CVE-2026-74267 9.8 CRITICAL net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring q

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74448

No comments yet

Leave a comment