Vulnerability in drm/amdkfd package: Ensure mm remain valid in svm deferred_list work

Kernel Updated 02 Oct 2025

Summary

24/04/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1001080: drm/amdkfd: Ensure mm remain valid in svm deferred_list work. Affects Kernel versions < 699d03880a8c52912d0899b4d0c8936db7cb5038. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The drm/amdkfd package is a component of the Linux Kernel that provides support for AMD GPUs in the kernel's Direct Rendering Manager (DRM) subsystem. It includes the AMDKFD driver, which enables the use of AMD GPUs for compute workloads. The package allows for the creation and management of shared virtual memory (SVM) for GPU compute tasks. SVM is a memory management technique that allows the GPU and CPU to share the same virtual address space, simplifying data transfer between the two. However, a vulnerability has been discovered in the package that could lead to potential security issues.

Vulnerability Detail

The vulnerability in the drm/amdkfd package arises from a failure to ensure that the memory mappings (mm) remain valid during svm deferred_list work. This could result in the use of invalid or freed memory, leading to various security risks such as information disclosure, privilege escalation, or denial of service attacks. The exact impact and attack vectors have not been proven yet. The vulnerability has been fixed in Linux Kernel version v5.17.3 by commit 699d03880a8c52912d0899b4d0c8936db7cb5038.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

In conclusion, the drm/amdkfd package in the Linux Kernel is vulnerable to a memory management issue that could lead to security risks. It is recommended to update the Linux Kernel to version v5.17.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →