CVE-2026-43206drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0fc8011f89feb8b2c3008583b777d097e1974660 before 3e04bc310d80b46eaf481f1fefcbcb37a187412d; from 0fc8011f89feb8b2c3008583b777d097e1974660 before de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f; from 0fc8011f89feb8b2c3008583b777d097e1974660 before b4034442cb090e4a980bdcc1540948606cbc951b; from 0fc8011f89feb8b2c3008583b777d097e1974660 before 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940; from 0fc8011f89feb8b2c3008583b777d097e1974660 before 75fb57efdd7863fffbc39db23e9cad7aafda26ed; from 0fc8011f89feb8b2c3008583b777d097e1974660 before bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b; from 0fc8011f89feb8b2c3008583b777d097e1974660 before 4e72f419e4ed44cb3b60506752d8688c20a60a9b; from 0fc8011f89feb8b2c3008583b777d097e1974660 before 8a70a26c9f34baea6c3199a9862ddaff4554a96d | CNA record |
linux linux_kernel linux:linux_kernel | from 4.17 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6 | NVD |
References
- https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412dpatch
- https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781fpatch
- https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951bpatch
- https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940patch
- https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26edpatch
- https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20bpatch
- https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9bpatch
- https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96dpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.