Use-After-Free Vulnerability in Linux Kernel's AMD KFD Driver
Summary
CVE-2025-37854: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. The AMD Kernel Fusion Driver (KFD) is a part of the Linux kernel that manages GPU resources for AMD graphics cards. This driver is crucial for enabling efficient GPU operations, particularly in high-performance computing and graphics rendering. However, it has been found to have a vulnerability that can lead to system crashes and data corruption.
Vulnerability Detail
In the Linux kernel, a use-after-free race condition exists within the AMD KFD driver. When the hardware scheduler hangs and a mode1 reset is initiated to recover the GPU, the KFD signals user space to abort processes. After the process aborts, user queues may still access freed system memory before the hardware reset occurs. This leads to a situation where KFD can allocate and reuse this freed memory, allowing user queues to write to it, which corrupts data structures and ultimately causes the driver to crash. This vulnerability poses significant risks, including system instability and potential data loss.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using the mode1 reset feature until the kernel is updated to the patched version.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's AMD KFD driver poses significant risks to system stability and data integrity. Users are encouraged to update their systems to the patched versions to mitigate these risks. Regular updates and monitoring for vulnerabilities are essential practices for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to data corruption or crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The primary risks include system crashes, data corruption, and potential loss of data integrity, which can affect the overall stability of the system.
While there are no specific workarounds, avoiding the use of the mode1 reset feature can help mitigate risks until the kernel is updated.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
