Linux Distros Unpatched Vulnerability : CVE-2026-80703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix missing authorization check in KFDIOCDBGTRAPDISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/k...

PT-2026-83003

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An authorization check is missing in the KFD IOC DBG TRAP DISABLE function within the drm/amdkfd module. This allows users with access to /dev/kfd to terminate active GPU debug sessions...

PT-2026-86728

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD IOC DBG TRAP DISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's debug session without...

amdgpu_amdkfd_submit_ib() Function Use-After-Free

The vulnerability of the amdgpuamdkfdsubmitib function in the drivers/gpu/drm/amd/amdgpu/amdgpuamdkfd.c driver for AMD GPU cores in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check the bounds when allocating an eventnotificationslot. Valid event IDs range from 0 to KFDSIGNALEVENTLIMIT. The allocateeventnotificationslot function has an option to specify an event ID to allocate; this option ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed an uint32 overflow in the EOP ring buffer size alignment. eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers, the expected EOP buffer size is calculated as ALIGNeopringbuffersize,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed the corruption in the listdel operation in kfdcriuresumesvm. The cleanup code for kfdcriuresumesvm iterates through svms-criusvmmetadatalist and calls kfree on each struct criusvmmetadata. However, this does not...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdkfd: Always resumeall after suspendall. It is necessary to restore any valid queues, even if the suspendall failed for some. Always execute removequeue, as this will schedule a GPU reset to remove the failed queue. V2:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed a 32-bit overflow in the calculation of the total CWSR size. The totalcwsrsize was calculated using a 32-bit value before being used as the allocation size for BO/SVM operations. When the ctxsaverestoreareasize...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clamp the BO size of the CRIU control stack checkpoint copy. CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from the hardware, without bounding it to the allocated BO region. If the HW field is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: The issue of leaking the QID bit in pqmcreatequeue has been fixed. When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early using ‘return...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on the CRIU restore queue type and mqdsize. We were not checking whether the values provided in the private data of the kfd CRIU restore were within bounds. For the queue type, add a const value...

Linux kernel DRM DoS

The vulnerability of DRM/AMDKFD components in Linux operating systems is related to the lack of data type conversion mechanisms. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2026-74447

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists when aligning the End-of-Pipe EOP ring buffer size. A local attacker could exploit this by providing a specially crafted size that, due to a 32-bit integer overflow, causes the system to bypass...

CVE-2026-74446

A flaw was found in the drm/amdkfd component of the Linux kernel. A race condition exists in the kfdcriucheckpointevents function where a mutex is not consistently held during event checkpointing. This allows a local attacker to cause memory corruption, potentially leading to privilege escalation...

SUSE CVE-2026-68257

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

SUSE CVE-2026-68258

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

SUSE CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...