CVE-2025-39706: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-05 · updated 2026-10-19
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/<pid> while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)

Affected products

Debian Linux: 11.0
Linux kernel: from 3.19 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4 — fixed in 6.1.149, 6.12.44, 6.16.4, 6.6.103

How to fix

Upgrade to a fixed version: Linux kernel 6.1.149, 6.12.44, 6.16.4, 6.6.103. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39706 or the next vulnerability affects your stack