CVE-2025-39706

drm/amdkfd: Destroy KFD debugfs after destroy KFD wq

MEDIUM
5.5
CVSS Score
Published: September 5, 2025 at 05:21 PM UTC
Updated: October 19, 2026 at 09:10 PM UTC
3 products affected across 3 vendorsLinux KernelDebian LinuxSIMATIC CN 4100

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/<pid> while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.19 ≤ v < 6.1.1496.13 ≤ v < 6.16.46.2 ≤ v < 6.6.1036.7 ≤ v < 6.12.443.194a488a7ad71401169cecee75dc94bcce642e2c53
Vendor states this is fixed in 2e58401a24e7b2d4ec619104e1a76590c1284a4c (fixed)
Vendor states this is fixed in 74ee7445c3b61c3bd899a54bd82c1982cb3a8206 (fixed)
Vendor states this is fixed in 910735ded17cc306625e7e1cdcc8102f7ac60994 (fixed)
Vendor states this is fixed in 96609a51e6134542bf90e053c2cd2fe4f61ebce3 (fixed)
Vendor states this is fixed in fc35c955da799ba62f6f977d58e0866d0251e3f8 (fixed)
Vendor states this is fixed in 3.19 (unaffected)
Vendor states this is fixed in 6.1.149 (unaffected)
Vendor states this is fixed in 6.12.44 (unaffected)
Vendor states this is fixed in 6.16.4 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.103 (unaffected)
v < V5.0
Affected range stops below V5.0, so it looks safe — our inference, not a vendor statement

References (7)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2e58401a24e7b2d4ec619104e1a76590c1284a4c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/74ee7445c3b61c3bd899a54bd82c1982cb3a8206
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/910735ded17cc306625e7e1cdcc8102f7ac60994
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/96609a51e6134542bf90e053c2cd2fe4f61ebce3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fc35c955da799ba62f6f977d58e0866d0251e3f8
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card