kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...

Linux Distros Unpatched Vulnerability : CVE-2026-72449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadat...

EUVD-2026-59754

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

EUVD-2026-59348

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing it from the list. The list head is left pointing a...

CVE-2026-68447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

CVE-2026-68259 drm/amdkfd: Check bounds in allocate_event_notification_slot

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

CVE-2026-68257 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

Linux Distros Unpatched Vulnerability : CVE-2026-68259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to...

CVE-2026-63882

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

CVE-2026-53376

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

The vulnerability of the kfddebugfs_hang_hws() function in the drivers/gpu/drm/amd/amdkfd/kfd_device.c driver for the Direct Rendering Infrastructure (DRI) of AMD graphics cards in Linux operating systems allows a hacker to cause a system failure.

The vulnerability of the kfddebugfshanghws function in the drivers/gpu/drm/amd/amdkfd/kfddevice.c driver for the Direct Rendering Infrastructure DRI of AMD graphics cards in Linux operating systems is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an...

UBUNTU-CVE-2026-53143

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpointmqd/restoremqd for KFDMQDTYPESDMA queues. These functions use sizeofstruct...

CVE-2026-46197

The CVE-2026-46197 issue affects the Linux kernel DRM/AMDKFD component, where the nattr field validation for SVM ioctl was insufficient against the reported buffer size, enabling out-of-bounds access via a user-controlled attribute count. The root cause is input size validation failure in the SVM...

PT-2026-44320

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1 Description An issue exists in the drm/amdkfd component where the nattr field is not properly validated against the buffer size. This allows for out-of-bounds buffer access through a user-controlled...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper bounds checking of the watchid during debugging address monitoring in the amdkfd driver...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check debugtrapenable before writing dbgevfile. In an interrupt context, the write dbgevfile operation will be executed via a work queue. This will cause the write dbgevfile operation to be executed after...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdkfd: Fixed a kernel panic that occurred when the reset attempt failed and was triggered again. In SRIOV configuration, the reset may fail to restore the ASIC to normal, but the cpsch function has already been called...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed a NULL pointer dereference in svmmigratetoram. ./drivers/gpu/drm/amd/amdkfd/kfdmigrate.c:985:58-62: Error: p is NULL, but it was dereferenced...

SUSE CVE-2026-43444

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unreserve bo if queue update failed Error handling path should unreserve bo then return failed. cherry picked from commit c24afed7de9ecce341825d8ab55a43a254348b33...

UBUNTU-CVE-2026-43444

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unreserve bo if queue update failed Error handling path should unreserve bo then return failed. cherry picked from commit c24afed7de9ecce341825d8ab55a43a254348b33...