CVE-2024-36949: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36949 affects the Linux kernel's AMD KFD (Kernel Fusion Driver) component. The vulnerability was discovered and disclosed on May 30, 2024. The issue occurs in the device reset functionality of the AMD KFD driver, where parallel device resets can lead to process eviction synchronization issues (Kernel Git).

The vulnerability stems from a race condition in the AMD KFD driver's device reset mechanism. When multiple devices undergo reset operations simultaneously, the first device calls kfd_suspend_all_processes() to evict all processes on all devices. However, other devices may initiate reset and recovery operations without waiting for the process eviction to complete. This can result in processes being restored before proper eviction, leading to page faults (Kernel Git).

If exploited, this vulnerability can cause page faults in the system when multiple AMD GPU devices are being reset simultaneously. The issue affects systems running AMD GPUs with the KFD driver enabled (NVD).

The vulnerability requires local access to a system with multiple AMD GPU devices and the ability to trigger parallel device resets. No known exploits have been reported in the wild at the time of assessment.

The issue has been resolved in the Linux kernel through a patch that synchronizes the device reset process. The fix ensures that all devices wait for the process eviction to complete before proceeding with recovery operations (Kernel Git).