22 matches found
CVE-2024-26817-amdkfd
-- CVE-2024-26817 I found a security vulnerability in AMD KFD in the following file drivers/gpu/drm/amd/amdkfd/kfdchardev.c, the ioctl identifier is AMDKFDIOCGETPROCESSAPERTURESNEW. In the function kfdioctlgetprocessaperturesnew, the user-provided data of args-numofnodes will be multiplied and...
CVE-2026-97429
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver subsystem. A race condition occurs during queue destruction when internal locks are released while waiting for a queue to resume, allowing a concurrent destroy operation to prematurely free the queue object. A local user could...
Linux Distros Unpatched Vulnerability : CVE-2026-80870
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores...
PT-2026-85789
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KFD CRIU restore flow where object IDs restored from userspace are not properly validated before being passed to the idr alloc function. Specifically, in the kfd...
SUSE CVE-2026-74353
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU Checkpoint/Restore in User-space operations on SDMA System Direct Memory Access queues. A local attacker can exploit this fl...
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watchid. This could lead to a buffer overflow, potentially allowing memory access outside of...
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU Checkpoint/Restore in User-space operations on SDMA System Direct Memory Access queues. A local attacker can exploit this fl...
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watchid. This could lead to a buffer overflow, potentially allowing memory access outside of...
UBUNTU-CVE-2026-74448
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqmcreatequeue When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early via 'return retval' without going through the...
CVE-2026-72449
CVE-2026-72449 : A Linux kernel flaw in drm/amdkfd causing list_del corruption during kfd_criu_resume_svm cleanup, leaving freed objects on the criu_svm_metadata_list. An unprivileged render-group user could trigger a use-after-free/double-free path via /dev/kfd. The fix adds list_del() before kf...
CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...
UBUNTU-CVE-2026-68257
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...
CVE-2026-63881
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver debugger component. The getqueueids function, responsible for handling queue identifiers, contains an integer overflow vulnerability. This occurs when calculating the size of an array, where a malicious local user could provide a...
SUSE-SU-2026:2632-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs bsc1266290. - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work...
SUSE-SU-2026:20570-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-40147: blk-throttle: fix access race during throttle policy activation bsc1253344. - CVE-2025-40257: mptcp: fix a race in mptcppmdeladdtimer...
SUSE-SU-2026:0472-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim bsc1256280. - CVE-2025-39880: libceph: fix invalid accesses to cephconnectionv1info bsc1250388. -...
EUVD-2024-53800
Malicious code in bioql PyPI...
CVE-2025-37854
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort exit, user queues still use the GPU to access system memory...