CVE-2025-39706CWE-476

CVE-2025-39706

Medium · published September 5, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Destroy KFD debugfs after destroy KFD wq

Since KFD proc content was moved to kernel debugfs, we can't destroy KFD

debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior

to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens

when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but

kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line

debugfs_remove_recursive(entry->proc_dentry);

tries to remove /sys/kernel/debug/kfd/proc/<pid> while

/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel

NULL pointer.

(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00150 · 3.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-09-05T22:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 3.19, < 6.1.1496.1.149
linux/linux_kernel≥ 6.2, < 6.6.1036.6.103
linux/linux_kernel≥ 6.7, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
debian/debian_linuxall versions—
References (7)
EPSS history
Timeline
  • 05 SEP 17:21Z
    drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
    cvelistv5