Answer in brief
CVE-2026-72449 records a Unknown severity vulnerability in drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <c8a8d350a273c005a48c64c4519d21b2a51c5ceb || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <506e635aed05dbdeef11e3c59f6e42980cda5b6d || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <838b57b3e7ce8cce0fda56d0861add3d464dd6c8 || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <96ac562a9ea3020981f536384711190841c81aa8 || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <e33a3bd5cb8d0cf1557dee014115f812c9686130 || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <8fa5655da368d0306c03e9dc9cda8ae2a7840926 | c8a8d350a273c005a48c64c4519d21b2a51c5ceb, 506e635aed05dbdeef11e3c59f6e42980cda5b6d, 838b57b3e7ce8cce0fda56d0861add3d464dd6c8, 96ac562a9ea3020981f536384711190841c81aa8, e33a3bd5cb8d0cf1557dee014115f812c9686130, 8fa5655da368d0306c03e9dc9cda8ae2a7840926 |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. (cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72449 records a Unknown severity vulnerability in drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <c8a8d350a273c005a48c64c4519d21b2a51c5ceb || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <506e635aed05dbdeef11e3c59f6e42980cda5b6d || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <838b57b3e7ce8cce0fda56d0861add3d464dd6c8 || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <96ac562a9ea3020981f536384711190841c81aa8 || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <e33a3bd5cb8d0cf1557dee014115f812c9686130 || >=2a909ae718715b3bac75d945e38dc0a5e4a0f1ba <8fa5655da368d0306c03e9dc9cda8ae2a7840926 | c8a8d350a273c005a48c64c4519d21b2a51c5ceb, 506e635aed05dbdeef11e3c59f6e42980cda5b6d, 838b57b3e7ce8cce0fda56d0861add3d464dd6c8, 96ac562a9ea3020981f536384711190841c81aa8, e33a3bd5cb8d0cf1557dee014115f812c9686130, 8fa5655da368d0306c03e9dc9cda8ae2a7840926 |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. (cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)
Quoted source text, attributed separately from HOL analysis.