The vulnerability in the Linux kernel's drm/amdkfd subsystem involves improper cleanup in the kfd_criu_resume_svm() function. Specifically, the cleanup code walks through svms->criu_svm_metadata_list and frees each struct criu_svm_metadata without removing it from the linked list. This leaves the list head pointing to freed memory (kmalloc-96 objects). If the same process issues a second AMDKFD_IOC_CRIU_OP ioctl, it re-enters list_empty(), which reads a dangling next pointer (use-after-free). The loop then walks freed entries and frees them again (double-free). This flaw is exploitable by an unprivileged render-group user via /dev/kfd with no additional capabilities. The patch adds list_del() before kfree() to properly unlink entries during cleanup, preventing use-after-free and double-free conditions.

An unprivileged user with access to /dev/kfd can trigger use-after-free and double-free conditions in kernel memory, potentially leading to system instability or escalation of privileges. The vulnerability arises from improper list management in kernel memory freeing routines, which can cause memory corruption.

A fix has been applied to the Linux kernel source code that properly removes list entries before freeing them, eliminating the use-after-free and double-free issues. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for the latest remediation guidance.