Answer in brief
CVE-2026-53144 records a Medium severity (CVSS 5.5) vulnerability in drm/amdkfd: fix NULL dereference in get_queue_ids(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a70a93fa568b4f05aba548dadb673703eccf5480 <62bd09e23a23da70f9aae02748eba3e6bd93095d || >=a70a93fa568b4f05aba548dadb673703eccf5480 <daeceb0fe2a19651c58bbfa3d9d515ecb6ca8996 || >=a70a93fa568b4f05aba548dadb673703eccf5480 <72e259a32084c42816152c346096d2edd4213e23 || >=a70a93fa568b4f05aba548dadb673703eccf5480 <e1965e8913cfbf17622ca12638e7a07f68ba0848 || >=a70a93fa568b4f05aba548dadb673703eccf5480 <2bd550b547deabef98bd3b017ff743b7c34d3a6d | 62bd09e23a23da70f9aae02748eba3e6bd93095d, daeceb0fe2a19651c58bbfa3d9d515ecb6ca8996, 72e259a32084c42816152c346096d2edd4213e23, e1965e8913cfbf17622ca12638e7a07f68ba0848, 2bd550b547deabef98bd3b017ff743b7c34d3a6d |
| Linux/Linuxgeneric | 6.5 | Not reported |
Published upstream
Jun 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL dereference in get_queue_ids() When usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() returns NULL. The callers check only IS_ERR() on the return value; since IS_ERR(NULL) == false the check passes, and suspend_queues() calls q_array_invalidate() which immediately dereferences NULL while iterating num_queues times. Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying num_queues > 0 with a zero queue_array_ptr, causing a kernel panic. A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op (q_array_invalidate never executes, and resume_queues already guards all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL) only when num_queues is non-zero and the pointer is absent; both callers already propagate IS_ERR() returns correctly to userspace. (cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4)
Quoted source text, attributed separately from HOL analysis.