CVE-2026-74448 drm/amdkfd: fix QID bit leak in pqm_create_queue()
A local attacker can exhaust GPU queue slots by triggering a memory allocation failure, causing denial of service for subsequent queue creations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74448?
CVE-2026-74448 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix QID bit leak in pqm_create_queue()
When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() returns early via 'return retval' without going through the err_create_queue cleanup label.
This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called, leaving the reserved QID bit permanently set in queue_slot_bitmap. Over time this leaks QID slots, potentially exhausting all available queue slots.
Fix this by replacing 'return retval' with 'goto err_allocate_pqn' so that clear_bit() is always called on the error path without touching the uninitialized pqn pointer.
AILIKFD-813
(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)
Which versions are affected by CVE-2026-74448?
How do I fix CVE-2026-74448?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74448 being exploited?
There is no known exploitation of CVE-2026-74448 in the wild and no public exploit code.
Sources
Also known as AZL-96450, BELL-CVE-2026-74448, DEBIAN-CVE-2026-74448, GHSA-8x3r-qg94-9qh5, UBUNTU-CVE-2026-74448.