A synchronization flaw in the Linux kernel amdkfd driver could allow a local authenticated attacker to trigger memory corruption or system instability.

The vulnerability occurs in the Checkpoint Restore in Userspace (CRIU) event handling logic within the amdkfd driver. An attacker with local access can exploit the lack of proper mutex locking to cause a race condition, potentially leading to unauthorized memory access.

With a CVSS score of 7.8, this vulnerability poses a significant risk to system stability and security. Exploitation could allow a local user to escalate privileges or cause a kernel panic, leading to service disruption and potential data loss in sensitive environments using GPU acceleration.

Immediate Action: Patch the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, 7.1.8, or later, to ensure the event_mutex is correctly utilized.

Proactive Monitoring: Review system audit logs for repeated crashes or unexpected behavior involving the amdkfd or DRM subsystems.

Compensating Controls: Limit access to the GPU device nodes and CRIU functionality to trusted users only to reduce the attack surface.

Public Exploit Available: No

Administrators should treat this high severity kernel vulnerability with urgency. Ensure that kernel updates are tested and deployed in accordance with organizational patch management policies to mitigate the risk of local exploitation.