CVE-2026-68447

A flaw was found in the Linux kernel's drm/amdkfd component. The Checkpoint/Restore in Userspace CRIU checkpoint process, which saves and restores the state of a running application, incorrectly copies the Memory Queue Descriptor MQD control stack. This occurs because the copy operation does not...

CVE-2026-68447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

EUVD-2026-57053

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

CVE-2026-68447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

CVE-2026-68447

Summary of CVE-2026-68447 (Linux kernel / drm amdkfd) : The issue arises during CRIU checkpoint copying of the MQD control stack. The code could copy the control stack without bounding to the allocated BO region; if the hardware field exceeds the queue’s control stack allocation, memcpy could rea...

CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

CVE-2026-68258

A flaw was found in the drm/amdkfd component of the Linux kernel. This vulnerability allows a local attacker to provide out-of-bounds values in the private data during a kfd CRIU restore operation. This improper input validation could lead to a memory safety issue, potentially resulting in a deni...

CVE-2026-68257

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists in the calculation of a memory allocation size. When processing large input values, this calculation can result in an undersized memory region, which can then be overrun by firmware. This could...

CVE-2026-68259

A flaw was found in the Linux kernel. A missing bounds check in the allocateeventnotificationslot function within the drm/amdkfd component allows a local attacker to provide an out-of-bounds event ID. This could lead to memory corruption, potentially resulting in a denial of service or privilege...

CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

CVE-2026-68259 drm/amdkfd: Check bounds in allocate_event_notification_slot

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

EUVD-2026-55360

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

EUVD-2026-55359

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

CVE-2026-68257

The CVE pertains to the Linux kernel driver component drm/amdkfd. The root cause is a 32-bit overflow in the CWSR total size calculation, where total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multipl...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed an out-of-bounds write in kfdeventpageset. The kfdeventpageset function writes KFDSIGNALEVENTLIMIT 8 bytes via memset, without checking the buffer size parameter. This allows unprivileged userspace to trigger an...

Linux Distros Unpatched Vulnerability : CVE-2026-68259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to...

Linux Distros Unpatched Vulnerability : CVE-2026-68258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were...

Linux Distros Unpatched Vulnerability : CVE-2026-68257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large...

SUSE-SU-2026:3156-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock bsc1264484. - CVE-2026-46052: ceph: only dadd negative dentries when they are unhashed bsc1267494....

SUSE CVE-2026-63881

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...