{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/amdkfd: Validate CRIU-restored IDs before idr_alloc  The KFD CRIU restore flow restores previously saved object IDs from userspace.  For event restore:    kfd_criu_restore_event()       -\u003e create_signal_event() / create_other_event()           -\u003e allocate_event_notification_slot()               -\u003e idr_alloc(..., *restore_id, *restore_id + 1, ...)  For BO restore:    criu_restore_memory_of_gpu()       -\u003e idr_alloc(..., bo_priv-\u003eidr_handle, ...)  In both cases, the restored ID comes from userspace-provided CRIU data.  idr_alloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INT_MAX, it can trigger a WARN in the IDR layer.  A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with panic_on_warn enabled.  Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc().  Add INT_MAX validation before using restored IDs in:  - kfd_criu_restore_event() - criu_restore_memory_of_gpu()  If the restored ID is invalid, return -EINVAL.  This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.",
  "id": "DEBIAN-CVE-2026-80870",
  "modified": "2026-09-14T16:47:46.696724762Z",
  "published": "2026-09-04T17:16:58.860Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80870"
    }
  ],
  "upstream": [
    "CVE-2026-80870"
  ]
}