The Linux kernel's drm/amdkfd component contained a NULL pointer dereference vulnerability in the get_queue_ids() function. When userspace calls kfd_ioctl_set_debug_trap() with num_queues > 0 and a NULL usr_queue_id_array, get_queue_ids() returns NULL. Callers only check IS_ERR() which returns false for NULL, leading to suspend_queues() calling q_array_invalidate() that dereferences the NULL pointer num_queues times, causing a kernel panic. The fix returns ERR_PTR(-EINVAL) when num_queues is non-zero and the pointer is NULL, preventing the NULL dereference. This vulnerability is tracked as CVE-2026-53144 and has a CVSS 3.1 vector indicating local attack complexity, low privileges required, no user interaction, and impact limited to availability (kernel panic).

Exploitation of this vulnerability results in a denial of service via kernel panic. There is no confidentiality or integrity impact reported. The attack requires local privileges and can cause system instability or crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves returning an error pointer when num_queues is non-zero and the usr_queue_id_array pointer is NULL, which prevents the NULL pointer dereference. Users should monitor official Linux kernel advisories for patches addressing CVE-2026-53144 and apply them once available.