CVE-2025-39706 drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
A null pointer dereference in the Linux kernel's AMD KFD driver causes a kernel hang when debugfs is destroyed prematurely.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39706?
CVE-2025-39706 is a medium-severity vulnerability in Debian Debian Linux, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/<pid> while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer.
(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)
Weakness: CWE-476
Which versions are affected by CVE-2025-39706?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-39706?
Apply the vendor's patch.
Is CVE-2025-39706 being exploited?
There is no known exploitation of CVE-2025-39706 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-66989, AZL-73725, BELL-CVE-2025-39706, DEBIAN-CVE-2025-39706, GHSA-8v4r-83gc-j76m, ROOT-OS-DEBIAN-11-CVE-2025-39706 and 5 more.