CVE-2026-68447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

EUVD-2026-57053

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

CVE-2026-68447

Summary of CVE-2026-68447 (Linux kernel / drm amdkfd) : The issue arises during CRIU checkpoint copying of the MQD control stack. The code could copy the control stack without bounding to the allocated BO region; if the hardware field exceeds the queue’s control stack allocation, memcpy could rea...

CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: amdkfd: The gangctxbo memory object is properly freed when attempting to initialize the user queue. The destructor of the gtt bo is declared as: void amdgpuamdkfdfreegttmemstruct amdgpudevice adev, void memobj; This function take...

kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: amdkfdfreegttmem clear the correct pointer Pass pointer reference to amdgpubounref to clear the correct pointer, otherwise amdgpubounref clear the local variable, the original pointer not set to NULL, this could cause...

SUSE CVE-2025-21842

In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gangctxbo when failed to init user queue The destructor of a gtt bo is declared as void amdgpuamdkfdfreegttmemstruct amdgpudevice adev, void memobj; Which takes void as the second parameter. GCC allows passi...

UBUNTU-CVE-2025-21842

In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gangctxbo when failed to init user queue The destructor of a gtt bo is declared as void amdgpuamdkfdfreegttmemstruct amdgpudevice adev, void memobj; Which takes void as the second parameter. GCC allows passi...

drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer

...

DEBIAN-CVE-2024-49991

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: amdkfdfreegttmem clear the correct pointer Pass pointer reference to amdgpubounref to clear the correct pointer, otherwise amdgpubounref clear the local variable, the original pointer not set to NULL, this could cause...

AZL-51756 CVE-2024-49991 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: amdkfdfreegttmem clear the correct pointer Pass pointer reference to amdgpubounref to clear the correct pointer, otherwise amdgpubounref clear the local variable, the original pointer not set to NULL, this could cause...