https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:42:17 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68447 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size</p> <p>CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue&#39;s control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace.</p> <p>Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm-&gt;ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout.</p> <p>(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size</p> <p>CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue&#39;s control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace.</p> <p>Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm-&gt;ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout.</p> <p>(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)</p> https://vulnerability.circl.lu/vuln/cve-2026-68447