CVE-2026-80870

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

The KFD CRIU restore flow restores previously saved object IDs from userspace.

For event restore:

kfdcriurestoreevent() -> createsignalevent() / createotherevent() -> allocateeventnotificationslot() -> idralloc(..., *restoreid, *restore_id + 1, ...)

For BO restore:

criurestorememoryofgpu() -> idralloc(..., bopriv->idr_handle, ...)

In both cases, the restored ID comes from userspace-provided CRIU data.

idralloc() expects the ID range values to fit within signed int limits. If a restored ID is larger than INTMAX, it can trigger a WARN in the IDR layer.

A kernel WARN is undesirable because it prints a warning trace and may cause a panic or reboot on systems with paniconwarn enabled.

Smatch reported these paths as allowing unchecked userspace values to reach idr_alloc().

Add INT_MAX validation before using restored IDs in:

• kfdcriurestore_event()
• criurestorememoryofgpu()

If the restored ID is invalid, return -EINVAL.

This prevents invalid restore data from reaching the IDR layer and avoids WARN-triggering paths, while keeping valid restore behavior unchanged.