CVE-2026-68257drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers(). (cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 325aa07165394b8e866ffe9ec1d4c99d9195b2f2 before b88ffe6593607364a8c06a48c6f29e55437cdf8e; from d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 before abce3276c57e36c955627307469b9f009057a467; from d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 before 865532d54eb57b660b1cb1b0e1755776ce21b849; from d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 before 2b0386d4293920e690c0e017708f999b93cc729b; 63600103d2ac5c09fdeec5b931b396e4e0efd5d8; from 6.12.59 before 6.12.101; from 6.17.9 before 6.18 | CNA record |
References
- https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e
- https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467
- https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849
- https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.