CVE-2023-54261

Root

Cause

The Linux kernel's AMDKFD driver for gfx11 (RDNA3) GPUs failed to assign the mqd_stride function pointer in the MQD (Memory Queue Descriptor) manager) manager callbacks. This callback was introduced in commit 2f77b9a242a2 ("drm/amdkfd: Update MQD management on multi XCC setup") but was not wired up for the gfx11 variant [1].

Exploitation

An attacker with local access and the ability to trigger debugfs operations on the affected system can cause a NULL pointer dereference. The missing callback leads to a crash when the kernel attempts to compute the MQD stride during debugfs read operations [1]. No special privileges beyond local user-level access to the debugfs interface are required.

Impact

Successful exploitation results in a denial of service (system crash or hang) due to the NULL pointer dereference. There is no evidence of privilege escalation or data corruption from this bug [1].

Mitigation

The fix was applied in the Linux kernel stable tree by adding the missing mqd_stride assignment for gfx11. Users should update to a kernel version containing commit 399b73d6b7720a772 or later [1]. No workaround is available other than restricting access to debugfs.