In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfdprocessdestroywq. Move kfdprocessdestroywq prior to kfddebugfsfini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfddebugfsfini but kfdprocessdestroywq calls kfddebugfsremoveprocess. This line debugfsremoverecursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/<pid> while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer.
(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)
[
{
"id": "CVE-2025-39706-06d38c63",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@910735ded17cc306625e7e1cdcc8102f7ac60994",
"deprecated": false,
"digest": {
"line_hashes": [
"267519696190629344757322902688857750898",
"258264582092792988182140191781858524126",
"308976840684979118997357281268836750009",
"252919812992978363248709904523563135640",
"256348965618627787137737647679774540559"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39706-9613f562",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e58401a24e7b2d4ec619104e1a76590c1284a4c",
"deprecated": false,
"digest": {
"line_hashes": [
"267519696190629344757322902688857750898",
"258264582092792988182140191781858524126",
"308976840684979118997357281268836750009",
"252919812992978363248709904523563135640",
"256348965618627787137737647679774540559"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39706-f167a444",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/gpu/drm/amd/amdkfd/kfd_module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96609a51e6134542bf90e053c2cd2fe4f61ebce3",
"deprecated": false,
"digest": {
"line_hashes": [
"267519696190629344757322902688857750898",
"258264582092792988182140191781858524126",
"308976840684979118997357281268836750009",
"252919812992978363248709904523563135640",
"256348965618627787137737647679774540559"
],
"threshold": 0.9
}
}
]