Vulnerability-Lookup

alsa-2026:57251

Vulnerability from osv_almalinux

Published

2026-08-20 00:00

Modified

2026-08-25 08:41

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

Bug Fix(es) and Enhancement(s):

CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954)
vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545)
cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459)
cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:57251	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-43206	REPORT
	https://access.redhat.com/security/cve/CVE-2026-43237	REPORT
	https://access.redhat.com/security/cve/CVE-2026-43493	REPORT
	https://access.redhat.com/security/cve/CVE-2026-45878	REPORT
	https://access.redhat.com/security/cve/CVE-2026-45991	REPORT
	https://access.redhat.com/security/cve/CVE-2026-46185	REPORT
	https://access.redhat.com/security/cve/CVE-2026-52991	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53136	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53143	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53329	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53356	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53374	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63879	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63884	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63886	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63888	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63952	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64017	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64219	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64379	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64382	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64386	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64560	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68388	REPORT
	https://bugzilla.redhat.com/2467156	REPORT
	https://bugzilla.redhat.com/2467202	REPORT
	https://bugzilla.redhat.com/2479812	REPORT
	https://bugzilla.redhat.com/2482113	REPORT
	https://bugzilla.redhat.com/2482124	REPORT
	https://bugzilla.redhat.com/2482558	REPORT
	https://bugzilla.redhat.com/2492403	REPORT
	https://bugzilla.redhat.com/2492719	REPORT
	https://bugzilla.redhat.com/2492768	REPORT
	https://bugzilla.redhat.com/2495941	REPORT
	https://bugzilla.redhat.com/2495950	REPORT
	https://bugzilla.redhat.com/2502188	REPORT
	https://bugzilla.redhat.com/2502321	REPORT
	https://bugzilla.redhat.com/2502329	REPORT
	https://bugzilla.redhat.com/2502422	REPORT
	https://bugzilla.redhat.com/2502443	REPORT
	https://bugzilla.redhat.com/2502449	REPORT
	https://bugzilla.redhat.com/2502463	REPORT
	https://bugzilla.redhat.com/2506790	REPORT
	https://bugzilla.redhat.com/2507042	REPORT
	https://bugzilla.redhat.com/2507135	REPORT
	https://bugzilla.redhat.com/2507216	REPORT
	https://bugzilla.redhat.com/2508504	REPORT
	https://bugzilla.redhat.com/2513470	REPORT
	https://errata.almalinux.org/10/ALSA-2026-57251.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-abi-stablelists"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-cross-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-doc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt-addons"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libperf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rtla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.  \n\nSecurity Fix(es):  \n\n  * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)\n  * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)\n  * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n  * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)\n  * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)\n  * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)\n  * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)\n  * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)\n  * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)\n  * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)\n  * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)\n  * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)\n  * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)\n  * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)\n  * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)\n  * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)\n  * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)\n  * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)\n  * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)\n  * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)\n  * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)\n  * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)\n  * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)\n  * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:AlmaLinux-223954)\n  * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z] (JIRA:AlmaLinux-224545)\n  * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459)\n  * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z] (JIRA:AlmaLinux-235812)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:57251",
  "modified": "2026-08-25T08:41:29Z",
  "published": "2026-08-20T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:57251"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43206"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43237"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43493"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45878"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45991"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-46185"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-52991"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53136"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53143"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53329"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53356"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53374"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63879"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63884"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63886"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63888"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63952"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64017"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64219"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64379"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64382"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64386"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64560"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68388"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2467156"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2467202"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482113"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482124"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482558"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492719"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492768"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2495941"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2495950"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502188"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502422"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502443"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502449"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2506790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507042"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507216"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2508504"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2513470"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-57251.html"
    }
  ],
  "related": [
    "CVE-2026-43206",
    "CVE-2026-43237",
    "CVE-2026-43493",
    "CVE-2026-45991",
    "CVE-2026-45878",
    "CVE-2026-46185",
    "CVE-2026-52991",
    "CVE-2026-53143",
    "CVE-2026-53136",
    "CVE-2026-53329",
    "CVE-2026-53356",
    "CVE-2026-53374",
    "CVE-2026-63884",
    "CVE-2026-63886",
    "CVE-2026-63952",
    "CVE-2026-63888",
    "CVE-2026-64017",
    "CVE-2026-63879",
    "CVE-2026-64219",
    "CVE-2026-64382",
    "CVE-2026-64379",
    "CVE-2026-64386",
    "CVE-2026-64560",
    "CVE-2026-68388"
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update"
}

CVE-2026-43206 (GCVE-0-2026-43206)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26

Title

drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/3e04bc310d80b46ea…
https://git.kernel.org/stable/c/de8d7a25cd2eb5875…
https://git.kernel.org/stable/c/b4034442cb090e4a9…
https://git.kernel.org/stable/c/4857c37c7ba9aa38b…
https://git.kernel.org/stable/c/75fb57efdd7863fff…
https://git.kernel.org/stable/c/bfcd6b53e1f4feb18…
https://git.kernel.org/stable/c/4e72f419e4ed44cb3…
https://git.kernel.org/stable/c/8a70a26c9f34baea6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < 3e04bc310d80b46eaf481f1fefcbcb37a187412d (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < b4034442cb090e4a980bdcc1540948606cbc951b (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940 (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < 75fb57efdd7863fffbc39db23e9cad7aafda26ed (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < 4e72f419e4ed44cb3b60506752d8688c20a60a9b (git) Affected: 0fc8011f89feb8b2c3008583b777d097e1974660 , < 8a70a26c9f34baea6c3199a9862ddaff4554a96d (git)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e04bc310d80b46eaf481f1fefcbcb37a187412d",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "b4034442cb090e4a980bdcc1540948606cbc951b",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "4857c37c7ba9aa38b9a4c694e8bd8d0091c87940",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "75fb57efdd7863fffbc39db23e9cad7aafda26ed",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "4e72f419e4ed44cb3b60506752d8688c20a60a9b",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            },
            {
              "lessThan": "8a70a26c9f34baea6c3199a9862ddaff4554a96d",
              "status": "affected",
              "version": "0fc8011f89feb8b2c3008583b777d097e1974660",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to  potential privilege\nescalation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local `/dev/kfd` ioctls, specifically allocating a KFD GPU memory object and passing its handle as `event_page_offset` to `AMDKFD_IOC_CREATE_EVENT`. There is no network, adjacent, or physical packet/device-input path.\nAC:L - The attacker controls the supplied event-page handle and can allocate a buffer smaller than `KFD_SIGNAL_EVENT_LIMIT * 8`, making the fixed-size `memset` out-of-bounds deterministic. No race or external condition is required.\nPR:L - The path is available to unprivileged userspace with access to KFD/AMDGPU device nodes, and the relevant ioctls have no capability flag or `capable()` gate. This is low privilege, not real administrator privilege.\nUI:N - Once a local attacker can execute code and open the device, exploitation only requires issuing ioctls. No victim user action is needed.\nS:U - The corruption occurs inside the kernel driver and impacts the same kernel security authority. This is standard local kernel compromise/DoS, not a cross-scope escape such as guest-to-host or IOMMU boundary bypass.\nC:H - The bug is an out-of-bounds kernel write into memory adjacent to a kernel-mapped GPU buffer, and kernel memory corruption can reasonably be leveraged to disclose sensitive kernel memory. Following the higher-severity rule for memory corruption, confidentiality impact is High.\nI:H - The vulnerable `memset` writes attacker-triggered data beyond the allocated object, giving a kernel memory corruption primitive. Out-of-bounds writes are scored as High integrity impact because they can plausibly be developed into privilege escalation or control-flow/data corruption.\nA:H - The out-of-bounds kernel write can corrupt adjacent kernel memory and readily crash or destabilize the kernel even without full exploitation. Kernel oops, panic, or persistent GPU/kernel failure is a High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:33.242Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d"
        },
        {
          "url": "https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940"
        },
        {
          "url": "https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d"
        }
      ],
      "title": "drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43206",
    "datePublished": "2026-05-06T11:28:10.937Z",
    "dateReserved": "2026-05-01T14:12:55.993Z",
    "dateUpdated": "2026-08-05T12:26:33.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43237 (GCVE-0-2026-43237)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26

Title

drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the logic for managing the last update fence directly into amdgpu_gem_va_update_vm. - Introduced checks for the timeline point to enable conditional replacement or addition of fences. v2: Addressed review comments from Christian. v3: Updated comments (Christian). v4: The previous version selected the fence too early and did not manage its reference correctly, which could lead to stale or freed fences being used. This resulted in refcount underflows and could crash when updating GPU timelines. The fence is now chosen only after the VA mapping work is completed, and its reference is taken safely. After exporting it to the VM timeline syncobj, the driver always drops its local fence reference, ensuring balanced refcounting and avoiding use-after-free on dma_fence. Crash signature: [ 205.828135] refcount_t: underflow; use-after-free. [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... [ 206.074014] Call Trace: [ 206.076488] <TASK> [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu] [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm] [ 206.094415] drm_ioctl+0x26e/0x520 [drm] [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu] [ 206.109387] __x64_sys_ioctl+0x96/0xe0 [ 206.113156] do_syscall_64+0x66/0x2d0 ... [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90 ... [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.553405] Call Trace: [ 206.553409] <IRQ> [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched] [ 206.553424] dma_fence_signal+0x30/0x60 [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched] [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0 [ 206.553437] dma_fence_signal+0x30/0x60 [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu] [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu] [ 206.554353] edac_mce_amd(E) ee1004(E) [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu] [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu] [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu] [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0 [ 206.555506] handle_irq_event+0x38/0x80 [ 206.555509] handle_edge_irq+0x92/0x1e0 [ 206.555513] __common_interrupt+0x3e/0xb0 [ 206.555519] common_interrupt+0x80/0xa0 [ 206.555525] </IRQ> [ 206.555527] <TASK> ... [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/e9e477d3197f7d895…
https://git.kernel.org/stable/c/0399b8416ecf64ef8…
https://git.kernel.org/stable/c/bd8150a1b3370a9f7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 70773bef4e091ff6d2a91e3dfb4f29013eb81f1f , < e9e477d3197f7d8955a042c0d7f53f78f13218ba (git) Affected: 70773bef4e091ff6d2a91e3dfb4f29013eb81f1f , < 0399b8416ecf64ef86ad23401fe23eabdb07831a (git) Affected: 70773bef4e091ff6d2a91e3dfb4f29013eb81f1f , < bd8150a1b3370a9f7761c5814202a3fe5a79f44f (git)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e9e477d3197f7d8955a042c0d7f53f78f13218ba",
              "status": "affected",
              "version": "70773bef4e091ff6d2a91e3dfb4f29013eb81f1f",
              "versionType": "git"
            },
            {
              "lessThan": "0399b8416ecf64ef86ad23401fe23eabdb07831a",
              "status": "affected",
              "version": "70773bef4e091ff6d2a91e3dfb4f29013eb81f1f",
              "versionType": "git"
            },
            {
              "lessThan": "bd8150a1b3370a9f7761c5814202a3fe5a79f44f",
              "status": "affected",
              "version": "70773bef4e091ff6d2a91e3dfb4f29013eb81f1f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4\n\nThis commit simplifies the amdgpu_gem_va_ioctl function, key updates\ninclude:\n - Moved the logic for managing the last update fence directly into\n   amdgpu_gem_va_update_vm.\n - Introduced checks for the timeline point to enable conditional\n   replacement or addition of fences.\n\nv2: Addressed review comments from Christian.\nv3: Updated comments (Christian).\nv4: The previous version selected the fence too early and did not manage its\n    reference correctly, which could lead to stale or freed fences being used.\n    This resulted in refcount underflows and could crash when updating GPU\n    timelines.\n    The fence is now chosen only after the VA mapping work is completed, and its\n    reference is taken safely. After exporting it to the VM timeline syncobj, the\n    driver always drops its local fence reference, ensuring balanced refcounting\n    and avoiding use-after-free on dma_fence.\n\n\tCrash signature:\n\t[  205.828135] refcount_t: underflow; use-after-free.\n\t[  205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110\n\t...\n\t[  206.074014] Call Trace:\n\t[  206.076488]  \u003cTASK\u003e\n\t[  206.078608]  amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu]\n\t[  206.084040]  ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]\n\t[  206.089994]  drm_ioctl_kernel+0x86/0xe0 [drm]\n\t[  206.094415]  drm_ioctl+0x26e/0x520 [drm]\n\t[  206.098424]  ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]\n\t[  206.104402]  amdgpu_drm_ioctl+0x4b/0x80 [amdgpu]\n\t[  206.109387]  __x64_sys_ioctl+0x96/0xe0\n\t[  206.113156]  do_syscall_64+0x66/0x2d0\n\t...\n\t[  206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90\n\t...\n\t[  206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0\n\t...\n\t[  206.553405] Call Trace:\n\t[  206.553409]  \u003cIRQ\u003e\n\t[  206.553415]  ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched]\n\t[  206.553424]  dma_fence_signal+0x30/0x60\n\t[  206.553427]  drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched]\n\t[  206.553434]  dma_fence_signal_timestamp_locked+0x6e/0xe0\n\t[  206.553437]  dma_fence_signal+0x30/0x60\n\t[  206.553441]  amdgpu_fence_process+0xd8/0x150 [amdgpu]\n\t[  206.553854]  sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu]\n\t[  206.554353]  edac_mce_amd(E) ee1004(E)\n\t[  206.554270]  amdgpu_irq_dispatch+0x150/0x230 [amdgpu]\n\t[  206.554702]  amdgpu_ih_process+0x6a/0x180 [amdgpu]\n\t[  206.555101]  amdgpu_irq_handler+0x23/0x60 [amdgpu]\n\t[  206.555500]  __handle_irq_event_percpu+0x4a/0x1c0\n\t[  206.555506]  handle_irq_event+0x38/0x80\n\t[  206.555509]  handle_edge_irq+0x92/0x1e0\n\t[  206.555513]  __common_interrupt+0x3e/0xb0\n\t[  206.555519]  common_interrupt+0x80/0xa0\n\t[  206.555525]  \u003c/IRQ\u003e\n\t[  206.555527]  \u003cTASK\u003e\n\t...\n\t[  206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0\n\t...\n\t[  206.555667] Kernel panic - not syncing: Fatal exception in interrupt"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through the local AMDGPU DRM `AMDGPU_GEM_VA` ioctl on `/dev/dri` render/primary nodes, not via network packets or physical hotplug.\nAC:L - The attacker controls the ioctl sequence, GEM objects, VM mappings, syncobj timeline output, and can repeatedly trigger the fence lifetime bug without relying on conditions outside their control.\nPR:L - The ioctl is `DRM_AUTH|DRM_RENDER_ALLOW`, so an unprivileged local user with access to the AMDGPU render node can reach it; no real root or init-namespace capability is required.\nUI:N - Once the attacker has local access to the device node, exploitation only requires issuing ioctls and does not require any victim user action.\nS:U - The bug corrupts kernel/driver synchronization state from within the same host kernel security authority; it is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - The bug is a use-after-free/stale `dma_fence` reference in kernel memory, and such fence object reuse can be groomed into broader kernel memory disclosure primitives.\nI:H - The freed `dma_fence` contains pointers, callback lists, and synchronization state used later by kernel code, making control-flow or arbitrary kernel memory modification defensible for scoring.\nA:H - The documented failure includes refcount underflow, page fault in `dma_fence_signal_timestamp_locked`, interrupt-context crash, and kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:48.364Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e9e477d3197f7d8955a042c0d7f53f78f13218ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/0399b8416ecf64ef86ad23401fe23eabdb07831a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd8150a1b3370a9f7761c5814202a3fe5a79f44f"
        }
      ],
      "title": "drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43237",
    "datePublished": "2026-05-06T11:28:32.300Z",
    "dateReserved": "2026-05-01T14:12:55.995Z",
    "dateUpdated": "2026-08-05T12:26:48.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43493 (GCVE-0-2026-43493)

Vulnerability from cvelistv5 – Published: 2026-05-19 10:44 – Updated: 2026-08-05 12:28

Title

crypto: pcrypt - Fix handling of MAY_BACKLOG requests

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ae7e95638d956d556…
https://git.kernel.org/stable/c/1d7f07df450bac330…
https://git.kernel.org/stable/c/76641449b28979ebd…
https://git.kernel.org/stable/c/9f1cbca178c03188e…
https://git.kernel.org/stable/c/eb34e243df57e32f4…
https://git.kernel.org/stable/c/77d55bc8675ee851e…
https://git.kernel.org/stable/c/46271895ddfb1ba41…
https://git.kernel.org/stable/c/915b692e6cb723aac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < ae7e95638d956d556d74b9abb9e780d3bd3dcd9e (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 1d7f07df450bac3301938fbc4251f2611be4084e (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 76641449b28979ebd6c02e9598367e119e385236 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 9f1cbca178c03188e201ed175251372149bb25f2 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < eb34e243df57e32f4c08fa191f3602ea19076276 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 77d55bc8675ee851ed639dc9be77325a8024cf67 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 915b692e6cb723aac658c25eb82c58fd81235110 (git)
Linux	Linux	Affected: 2.6.34 Unaffected: 0 , < 2.6.34 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/pcrypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae7e95638d956d556d74b9abb9e780d3bd3dcd9e",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "1d7f07df450bac3301938fbc4251f2611be4084e",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "76641449b28979ebd6c02e9598367e119e385236",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "9f1cbca178c03188e201ed175251372149bb25f2",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "eb34e243df57e32f4c08fa191f3602ea19076276",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "77d55bc8675ee851ed639dc9be77325a8024cf67",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "915b692e6cb723aac658c25eb82c58fd81235110",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/pcrypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY.  Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - pcrypt AEAD can sit under network-facing kernel crypto consumers such as kTLS/TIPC that process peer-supplied records or packets. In the highest reasonable deployment, a remote peer can drive the vulnerable encrypt/decrypt path through network traffic.\nAC:L - The trigger is child crypto backlog behavior under `CRYPTO_TFM_REQ_MAY_BACKLOG`; an attacker can induce queue pressure with concurrent requests or traffic. There is no race that depends on conditions outside the attacker\u0027s control.\nPR:N - The network-facing path requires no kernel privileges from the remote peer. The local AF_ALG AEAD path also has no capability gate, but the higher-severity network scenario is defensible.\nUI:N - No victim interaction is required once the affected crypto consumer is configured. The attacker only sends data or submits crypto requests.\nS:U - The bug corrupts kernel crypto/request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - Mishandling `-EBUSY` can complete and free the request while the child request remains queued, leading to use-after-free on later callbacks. A kernel UAF is reasonably exploitable for high-impact information disclosure.\nI:H - The stale callback reuses freed request/padata memory and can drive list operations and completion paths on attacker-reclaimed objects. This is memory corruption with a plausible path to arbitrary write or control-flow corruption.\nA:H - At minimum, the premature completion and later queued callback can dereference or manipulate freed kernel memory. That can produce kernel oops/panic or list corruption, giving high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:16.602Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"
        },
        {
          "url": "https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"
        },
        {
          "url": "https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"
        },
        {
          "url": "https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"
        },
        {
          "url": "https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"
        }
      ],
      "title": "crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43493",
    "datePublished": "2026-05-19T10:44:25.402Z",
    "dateReserved": "2026-05-01T14:12:56.013Z",
    "dateUpdated": "2026-08-05T12:28:16.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45878 (GCVE-0-2026-45878)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:16 – Updated: 2026-08-05 12:28

Title

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id. If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array. drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely. This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, 434 uint32_t watch_id) 435 { 436 int r; 437 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id)) kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined). 439 return -EINVAL; 440 441 if (!pdd->dev->kfd->shared_resources.enable_mes) { 442 r = debug_lock_and_unmap(pdd->dev->dqm); 443 if (r) 444 return r; 445 } 446 447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false); --> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch( 449 pdd->dev->adev, 450 watch_id); v2: (as per, Jonathan Kim) - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path. - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/971bf8e61e9b4abaa…
https://git.kernel.org/stable/c/a0d367e13db63a6ed…
https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6…
https://git.kernel.org/stable/c/3c38a0f07aa2bfef2…
https://git.kernel.org/stable/c/5a19302cab5cec7ae…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 971bf8e61e9b4abaacf9b35eaf76ec222758f9d6 (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488 (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 2b36c0c1bcbbe15f6cfa9652084b3124c835a150 (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 3c38a0f07aa2bfef2b219b1f045534ad93f85afd (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 5a19302cab5cec7ae7f1a60c619951e6c17d8742 (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "971bf8e61e9b4abaacf9b35eaf76ec222758f9d6",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "2b36c0c1bcbbe15f6cfa9652084b3124c835a150",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "3c38a0f07aa2bfef2b219b1f045534ad93f85afd",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "5a19302cab5cec7ae7f1a60c619951e6c17d8742",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nThe address watch clear code receives watch_id as an unsigned value\n(u32), but some helper functions were using a signed int and checked\nbits by shifting with watch_id.\n\nIf a very large watch_id is passed from userspace, it can be converted\nto a negative value.  This can cause invalid shifts and may access\nmemory outside the watch_points array.\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nFix this by checking that watch_id is within MAX_WATCH_ADDRESSES before\nusing it.  Also use BIT(watch_id) to test and clear bits safely.\n\nThis keeps the behavior unchanged for valid watch IDs and avoids\nundefined behavior for invalid ones.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448\nkfd_dbg_trap_clear_dev_address_watch() error: buffer overflow\n\u0027pdd-\u003ewatch_points\u0027 4 \u003c= u32max user_rl=\u00270-3,2147483648-u32max\u0027 uncapped\n\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c\n    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,\n    434                                         uint32_t watch_id)\n    435 {\n    436         int r;\n    437\n    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))\n\nkfd_dbg_owns_dev_watch_id() doesn\u0027t check for negative values so if\nwatch_id is larger than INT_MAX it leads to a buffer overflow.\n(Negative shifts are undefined).\n\n    439                 return -EINVAL;\n    440\n    441         if (!pdd-\u003edev-\u003ekfd-\u003eshared_resources.enable_mes) {\n    442                 r = debug_lock_and_unmap(pdd-\u003edev-\u003edqm);\n    443                 if (r)\n    444                         return r;\n    445         }\n    446\n    447         amdgpu_gfx_off_ctrl(pdd-\u003edev-\u003eadev, false);\n--\u003e 448         pdd-\u003ewatch_points[watch_id] = pdd-\u003edev-\u003ekfd2kgd-\u003eclear_address_watch(\n    449                                                         pdd-\u003edev-\u003eadev,\n    450                                                         watch_id);\n\nv2: (as per, Jonathan Kim)\n - Add early watch_id \u003e= MAX_WATCH_ADDRESSES validation in the set path to\n   match the clear path.\n - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through an ioctl (AMDKFD_IOC_DBG_TRAP) on the local /dev/kfd device node; there is no network or remote path.\nAC:L - The attacker fully controls both the allocation of a watch point and the crafted watch_id; the negative-shift behavior is deterministic on x86, so the out-of-bounds write is triggered reliably and repeatably.\nPR:L - The ioctl has flags=0 with no capability check, and self-debugging (target==p) is permitted, so any unprivileged local user with access to the GPU device node (/dev/kfd) can reach the bug; no root/CAP_SYS_ADMIN is required.\nUI:N - The attacking process performs the enable/allocate/clear sequence entirely on its own; no action by another user is needed.\nS:U - The out-of-bounds write corrupts kernel memory within the same kernel security authority; it does not cross into a separate authority such as a hypervisor or IOMMU boundary.\nC:H - The bug is a kernel out-of-bounds write (memory corruption) that can be groomed to overwrite adjacent kernel structures (e.g., size/pointer fields), which can be leveraged to enable information disclosure.\nI:H - Attacker-influenced out-of-bounds write of a 32-bit value into kernel memory at a controllable offset is a direct kernel memory-corruption/write primitive.\nA:H - The out-of-bounds write into unmapped or critical kernel memory readily causes a kernel oops/panic, producing a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:38.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742"
        }
      ],
      "title": "drm/amdkfd: Fix watch_id bounds checking in debug address watch v2",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45878",
    "datePublished": "2026-05-27T12:16:49.108Z",
    "dateReserved": "2026-05-13T15:03:33.081Z",
    "dateUpdated": "2026-08-05T12:28:38.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45991 (GCVE-0-2026-45991)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:55 – Updated: 2026-08-05 12:29

Title

udf: fix partition descriptor append bookkeeping

Summary

In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_descriptor() deduplicates entries by partition number, but appended slots never record partnum. As a result duplicate Partition Descriptors are appended repeatedly and num_part_descs keeps growing. Once the table is full, the growth path still sizes the allocation from partnum even though inserts are indexed by num_part_descs. If partnum is already aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep the old capacity and the next append writes past the end of the table. Store partnum in the appended slot and size growth from the next append count so deduplication and capacity tracking follow the same model.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/ad3c0c4400686f6f3…
https://git.kernel.org/stable/c/68013a9bd4c01acd4…
https://git.kernel.org/stable/c/e8474cfbac9ada2cd…
https://git.kernel.org/stable/c/058b451b1039f056d…
https://git.kernel.org/stable/c/b5597bb83fc37b5b5…
https://git.kernel.org/stable/c/08fa5d818e5bf53c7…
https://git.kernel.org/stable/c/08841b06fa64d8edb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < ad3c0c4400686f6f37b382aaa48fac2b9aefccbe (git) Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < 68013a9bd4c01acd42073715f00e1a1992f089ee (git) Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < e8474cfbac9ada2cdaa4eaedec22aadfa0f58559 (git) Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < 058b451b1039f056d1362c4fec2229e522366ab0 (git) Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < b5597bb83fc37b5b5da74a4453fa920b932cf39a (git) Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < 08fa5d818e5bf53c7ca234d88ba334f32004e9b6 (git) Affected: ee4af50ca94f58afc3532662779b9cf80bbe27c8 , < 08841b06fa64d8edbd1a21ca6e613420c90cc4b8 (git) Affected: 7f401f160a9c7a1ff84ba3cb9b2f636d1f5cfb6b (git) Affected: 4.18.7 , < 4.19 (semver)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad3c0c4400686f6f37b382aaa48fac2b9aefccbe",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "68013a9bd4c01acd42073715f00e1a1992f089ee",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "e8474cfbac9ada2cdaa4eaedec22aadfa0f58559",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "058b451b1039f056d1362c4fec2229e522366ab0",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "b5597bb83fc37b5b5da74a4453fa920b932cf39a",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "08fa5d818e5bf53c7ca234d88ba334f32004e9b6",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "lessThan": "08841b06fa64d8edbd1a21ca6e613420c90cc4b8",
              "status": "affected",
              "version": "ee4af50ca94f58afc3532662779b9cf80bbe27c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f401f160a9c7a1ff84ba3cb9b2f636d1f5cfb6b",
              "versionType": "git"
            },
            {
              "lessThan": "4.19",
              "status": "affected",
              "version": "4.18.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.18.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: fix partition descriptor append bookkeeping\n\nMounting a crafted UDF image with repeated partition descriptors can\ntrigger a heap out-of-bounds write in part_descs_loc[].\n\nhandle_partition_descriptor() deduplicates entries by partition number,\nbut appended slots never record partnum. As a result duplicate\nPartition Descriptors are appended repeatedly and num_part_descs keeps\ngrowing.\n\nOnce the table is full, the growth path still sizes the allocation from\npartnum even though inserts are indexed by num_part_descs. If partnum is\nalready aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep\nthe old capacity and the next append writes past the end of the table.\n\nStore partnum in the appended slot and size growth from the next append\ncount so deduplication and capacity tracking follow the same model."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in mount-time on-disk parsing, reachable locally via loop-device mounts or removable-media handling (e.g. udisks2), not over any network protocol.\nAC:L - The out-of-bounds write is deterministic for a crafted image with repeated partition descriptors at a 32-aligned partnum; no race or attacker-uncontrollable condition is involved.\nPR:L - Direct mount needs CAP_SYS_ADMIN, but on typical workstations/kiosks an unprivileged local user can get a crafted UDF image mounted through privileged auto-mount/udisks2 helpers, so low privilege suffices.\nUI:N - The attacker supplies and triggers the mount of their own crafted image; no action by a separate victim user is required.\nS:U - The corruption stays within the kernel\u0027s own security authority; there is no cross-boundary (VM/IOMMU) escape.\nC:H - A controlled heap out-of-bounds write corrupts adjacent heap objects and can be leveraged (e.g. corrupting length/pointer fields) into an arbitrary read and information disclosure.\nI:H - The bug is a heap out-of-bounds write of attacker-influenced values at attacker-reachable offsets \u2014 a write primitive exploitable for further corruption and control-flow hijack.\nA:H - Heap metadata/object corruption from the out-of-bounds write reliably leads to a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:03.928Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad3c0c4400686f6f37b382aaa48fac2b9aefccbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/68013a9bd4c01acd42073715f00e1a1992f089ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8474cfbac9ada2cdaa4eaedec22aadfa0f58559"
        },
        {
          "url": "https://git.kernel.org/stable/c/058b451b1039f056d1362c4fec2229e522366ab0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5597bb83fc37b5b5da74a4453fa920b932cf39a"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fa5d818e5bf53c7ca234d88ba334f32004e9b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/08841b06fa64d8edbd1a21ca6e613420c90cc4b8"
        }
      ],
      "title": "udf: fix partition descriptor append bookkeeping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45991",
    "datePublished": "2026-05-27T12:55:43.449Z",
    "dateReserved": "2026-05-13T15:03:33.091Z",
    "dateUpdated": "2026-08-05T12:29:03.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46185 (GCVE-0-2026-46185)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:36 – Updated: 2026-08-05 12:30

Title

smb/client: fix out-of-bounds read in symlink_data()

Summary

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer only contains the base SMB2 header (64 bytes), accessing err->ErrorContextCount (at offset 66) or err->ByteCount later in symlink_data() will cause an out-of-bounds read.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/2be11faf79e49fb82…
https://git.kernel.org/stable/c/ef6495d4df6e7af8f…
https://git.kernel.org/stable/c/15dc0a4de743a1aaa…
https://git.kernel.org/stable/c/b8c8a704f0bc133de…
https://git.kernel.org/stable/c/b9561402489d41149…
https://git.kernel.org/stable/c/d62b8d236fab503c6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < 2be11faf79e49fb8250a181ff0b4d2b2f084af83 (git) Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < ef6495d4df6e7af8f3de67e65150881c880f696c (git) Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < 15dc0a4de743a1aaa7b859b3aea79f08c695396c (git) Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < b8c8a704f0bc133deb171f6aeb6f3a684203e212 (git) Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < b9561402489d41149f63e001a74384863b7b30a6 (git) Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < d62b8d236fab503c6fec1d3e9a38bea71feaca20 (git) Affected: 2d046892a493d9760c35fdaefc3017f27f91b621 (git) Affected: 6.0.16 , < 6.1 (semver)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.88 , ≤ 6.12.* (semver) Unaffected: 6.18.30 , ≤ 6.18.* (semver) Unaffected: 7.0.7 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2be11faf79e49fb8250a181ff0b4d2b2f084af83",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "ef6495d4df6e7af8f3de67e65150881c880f696c",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "15dc0a4de743a1aaa7b859b3aea79f08c695396c",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "b8c8a704f0bc133deb171f6aeb6f3a684203e212",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "b9561402489d41149f63e001a74384863b7b30a6",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "d62b8d236fab503c6fec1d3e9a38bea71feaca20",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2d046892a493d9760c35fdaefc3017f27f91b621",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix out-of-bounds read in symlink_data()\n\nSince smb2_check_message() returns success without length validation for\nthe symlink error response, in symlink_data() it is possible for\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\nonly contains the base SMB2 header (64 bytes), accessing\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\nsymlink_data() will cause an out-of-bounds read."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is in the SMB *client*, triggered by a crafted symlink error response from a remote (malicious, compromised, or MITM) SMB server over TCP/445; it processes attacker-controlled data from a remote network peer.\nAC:L - A malicious server can deterministically return a CREATE response with STATUS_STOPPED_ON_SYMLINK and len \u003c calc_len (e.g., only the 64-byte base header), reliably reaching symlink_data() with no race or attacker-uncontrolled condition.\nPR:N - The attacker is the remote SMB server; it requires no credentials or privileges on the victim client to send the malformed response, which is parsed during normal open/error handling.\nUI:N - Once a share is mounted (e.g., persistent fstab/autofs mount to a compromised or MITM\u0027d server), routine file access makes the server return the crafted symlink error with no additional victim action required per exploit.\nS:U - The out-of-bounds read stays within the client kernel\u0027s own memory and security authority; no privilege or sandbox boundary is crossed.\nC:H - An out-of-bounds read of adjacent kernel heap memory; in this same symlink-parse path (cf. CVE-2026-31613) OOB bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).\nI:N - The flaw is purely an out-of-bounds read of the error response buffer; it does not modify kernel memory.\nA:H - Reading past the message bounds can dereference invalid/unmapped memory and oops the client kernel, causing a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:18.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2be11faf79e49fb8250a181ff0b4d2b2f084af83"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c"
        },
        {
          "url": "https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20"
        }
      ],
      "title": "smb/client: fix out-of-bounds read in symlink_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46185",
    "datePublished": "2026-05-28T09:36:39.318Z",
    "dateReserved": "2026-05-13T15:03:33.103Z",
    "dateUpdated": "2026-08-05T12:30:18.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52991 (GCVE-0-2026-52991)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-08-20 12:31

Title

sched/psi: fix race between file release and pressure write

Summary

In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate CPUs: CPU0 CPU1 ==== ==== vfs_rmdir() kernfs_iop_rmdir() cgroup_rmdir() cgroup_kn_lock_live() cgroup_destroy_locked() cgroup_addrm_files() cgroup_rm_file() kernfs_remove_by_name() kernfs_remove_by_name_ns() vfs_write() __kernfs_remove() new_sync_write() kernfs_drain() kernfs_fop_write_iter() kernfs_drain_open_files() cgroup_file_write() kernfs_release_file() pressure_write() cgroup_file_release() ctx = of->priv; kfree(ctx); of->priv = NULL; cgroup_kn_unlock() cgroup_kn_lock_live() cgroup_get(cgrp) cgroup_kn_unlock() if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of->priv performed within cgroup_file_release(). However, the operations involving of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered. Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write(). And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired. In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition: CPU0: write memory.pressure CPU1: write cgroup.pressure=0 =========================== ============================= kernfs_fop_write_iter() kernfs_get_active_of(of) pressure_write() cgroup_kn_lock_live(memory.pressure) cgroup_tryget(cgrp) kernfs_break_active_protection(kn) ... blocks on cgroup_mutex cgroup_pressure_write() cgroup_kn_lock_live(cgroup.pressure) cgroup_file_show(memory.pressure, false) kernfs_show(false) kernfs_drain_open_files() cgroup_file_release(of) kfree(ctx) of->priv = NULL cgroup_kn_unlock() ... acquires cgroup_mutex ctx = of->priv; // may now be NULL if (ctx->psi.trigger) // NULL dereference Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this. Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation. [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace: pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/03dc070fa0fc3cb40…
https://git.kernel.org/stable/c/d4352c0709bfd38c7…
https://git.kernel.org/stable/c/a5b98009f16d8a5fb…
https://access.redhat.com/security/cve/CVE-2026-52991	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492403	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:57251	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57252	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57253	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57254	vendor-advisoryx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Linux	Linux	Affected: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 , < 03dc070fa0fc3cb4068693f468ccd5f8a7e58282 (git) Affected: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 , < d4352c0709bfd38c752fccbde7fd72a82ac78f23 (git) Affected: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 , < a5b98009f16d8a5fb4a8ff9a193f5735515c38fa (git)
Linux	Linux	Affected: 5.2 Unaffected: 0 , < 5.2 (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Pressure Stall Information (PSI) subsystem. A race condition exists between the file release and pressure write operations, specifically concerning the `priv` member of `struct kernfs_open_file`. This can lead to a use-after-free vulnerability or a NULL dereference, potentially causing system instability or a denial of service. The issue arises when the `priv` member is deallocated during a cgroup file release while a pressure write operation attempts to access it, or when it becomes NULL before being accessed."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T12:31:57.785Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52991"
          },
          {
            "name": "RHBZ#2492403",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52991.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57251"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57252"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57253"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57254"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:57251: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57252: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57253: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57254: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: sched/psi: fix race between file release and pressure write",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03dc070fa0fc3cb4068693f468ccd5f8a7e58282",
              "status": "affected",
              "version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
              "versionType": "git"
            },
            {
              "lessThan": "d4352c0709bfd38c752fccbde7fd72a82ac78f23",
              "status": "affected",
              "version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
              "versionType": "git"
            },
            {
              "lessThan": "a5b98009f16d8a5fb4a8ff9a193f5735515c38fa",
              "status": "affected",
              "version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: fix race between file release and pressure write\n\nA potential race condition exists between pressure write and cgroup file\nrelease regarding the priv member of struct kernfs_open_file, which\ntriggers the uaf reported in [1].\n\nConsider the following scenario involving execution on two separate CPUs:\n\n   CPU0\t\t\t\t\tCPU1\n   ====\t\t\t\t\t====\n\t\t\t\t\tvfs_rmdir()\n\t\t\t\t\tkernfs_iop_rmdir()\n\t\t\t\t\tcgroup_rmdir()\n\t\t\t\t\tcgroup_kn_lock_live()\n\t\t\t\t\tcgroup_destroy_locked()\n\t\t\t\t\tcgroup_addrm_files()\n\t\t\t\t\tcgroup_rm_file()\n\t\t\t\t\tkernfs_remove_by_name()\n\t\t\t\t\tkernfs_remove_by_name_ns()\n vfs_write()\t\t\t\t__kernfs_remove()\n new_sync_write()\t\t\tkernfs_drain()\n kernfs_fop_write_iter()\t\tkernfs_drain_open_files()\n cgroup_file_write()\t\t\tkernfs_release_file()\n pressure_write()\t\t\tcgroup_file_release()\n ctx = of-\u003epriv;\n\t\t\t\t\tkfree(ctx);\n \t\t\t\t\tof-\u003epriv = NULL;\n\t\t\t\t\tcgroup_kn_unlock()\n cgroup_kn_lock_live()\n cgroup_get(cgrp)\n cgroup_kn_unlock()\n if (ctx-\u003epsi.trigger)  // here, trigger uaf for ctx, that is of-\u003epriv\n\nThe cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards\nthe memory deallocation of of-\u003epriv performed within cgroup_file_release().\nHowever, the operations involving of-\u003epriv executed within pressure_write()\nare not entirely covered by the protection of cgroup_mutex. Consequently,\nif the code in pressure_write(), specifically the section handling the\nctx variable executes after cgroup_file_release() has completed, a uaf\nvulnerability involving of-\u003epriv is triggered.\n\nTherefore, the issue can be resolved by extending the scope of the\ncgroup_mutex lock within pressure_write() to encompass all code paths\ninvolving of-\u003epriv, thereby properly synchronizing the race condition\noccurring between cgroup_file_release() and pressure_write().\n\nAnd, if an live kn lock can be successfully acquired while executing\nthe pressure write operation, it indicates that the cgroup deletion\nprocess has not yet reached its final stage; consequently, the priv\npointer within open_file cannot be NULL. Therefore, the operation to\nretrieve the ctx value must be moved to a point *after* the live kn\nlock has been successfully acquired.\n\nIn another situation, specifically after entering cgroup_kn_lock_live()\nbut before acquiring cgroup_mutex, there exists a different class of\nrace condition:\n\nCPU0: write memory.pressure               CPU1: write cgroup.pressure=0\n===========================\t\t  =============================\n\nkernfs_fop_write_iter()\n kernfs_get_active_of(of)\n pressure_write()\n   cgroup_kn_lock_live(memory.pressure)\n     cgroup_tryget(cgrp)\n     kernfs_break_active_protection(kn)\n     ... blocks on cgroup_mutex\n\n                                     \t  cgroup_pressure_write()\n                                     \t  cgroup_kn_lock_live(cgroup.pressure)\n                                     \t  cgroup_file_show(memory.pressure, false)\n                                     \t    kernfs_show(false)\n                                     \t      kernfs_drain_open_files()\n                                     \t        cgroup_file_release(of)\n                                     \t          kfree(ctx)\n                                     \t            of-\u003epriv = NULL\n                                     \t  cgroup_kn_unlock()\n\n   ... acquires cgroup_mutex\n   ctx = of-\u003epriv;        // may now be NULL\n   if (ctx-\u003epsi.trigger)  // NULL dereference\n\nConsequently, there is a possibility that of-\u003epriv is NULL, the pressure\nwrite needs to check for this.\n\nNow that the scope of the cgroup_mutex has been expanded, the original\nexplicit cgroup_get/put operations are no longer necessary, this is\nbecause acquiring/releasing the live kn lock inherently executes a\ncgroup get/put operation.\n\n[1]\nBUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\nCall Trace:\n pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\n cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local syscalls writing to cgroup v2 PSI control files such as cpu.pressure, memory.pressure, io.pressure, or irq.pressure. There is no network or physical packet-processing path involved.\nAC:L - The attacker can control both sides of the race by concurrently writing a pressure trigger and removing the cgroup or disabling cgroup.pressure to drain open files. No unusual victim state or externally uncontrolled timing condition is required beyond a repeatable local race.\nPR:L - The pressure files are local cgroupfs files; root can always reach them, and unprivileged users can reach equivalent files in delegated cgroup sub-hierarchies they can create and manage. This is therefore low local privilege rather than init-namespace administrator-only.\nUI:N - Exploitation only requires attacker-controlled syscalls against cgroupfs file descriptors. No victim user action is needed.\nS:U - The vulnerability corrupts kernel memory from a kernel cgroup/PSI file operation and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a slab use-after-free of struct cgroup_file_ctx, and the stale object can be raced with attacker-influenced heap reuse. Following kernel UAF scoring guidance, this can plausibly support kernel memory disclosure primitives.\nI:H - The pre-fix path can read and later store through the freed ctx-\u003epsi.trigger field after the object has been freed, giving a plausible write/corruption primitive with heap grooming. Following kernel UAF scoring guidance, integrity impact is high.\nA:H - The reported bug is a KASAN slab-use-after-free in pressure_write and can crash or oops the kernel. Repeated local triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:26.785Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa"
        }
      ],
      "title": "sched/psi: fix race between file release and pressure write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52991",
    "datePublished": "2026-06-24T16:29:04.810Z",
    "dateReserved": "2026-06-09T07:44:35.377Z",
    "dateUpdated": "2026-08-20T12:31:57.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53136 (GCVE-0-2026-53136)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-06-29 04:18

Title

drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe. Clamp each register count to the destination array size using min_t() before the copy loops, in both get_integrated_info_v11() and get_integrated_info_v2_1(). (cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)

Severity

No CVSS data available.

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/029571d5114065078…
https://git.kernel.org/stable/c/5f8b39452fb16f507…
https://git.kernel.org/stable/c/4d1c3c26c2ab1842e…
https://git.kernel.org/stable/c/d6be8e59af412623e…
https://git.kernel.org/stable/c/3f32d52ec604c6597…
https://git.kernel.org/stable/c/8aaa7e317fbd4beb9…
https://git.kernel.org/stable/c/fb0707ce00eef4e2d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < 029571d51140650783be4fb98fe7cb4754752086 (git) Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < 5f8b39452fb16f507c9e4d8b4a83ce27e893307c (git) Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < 4d1c3c26c2ab1842e139e61983395d64bd2e518b (git) Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < d6be8e59af412623e3d874be3a048406c0edfe60 (git) Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < 3f32d52ec604c659725d865cf8cc6a17a33f9c6a (git) Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < 8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117 (git) Affected: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a , < fb0707ce00eef4e2d60c3020e1c0432739703e4a (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "029571d51140650783be4fb98fe7cb4754752086",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            },
            {
              "lessThan": "5f8b39452fb16f507c9e4d8b4a83ce27e893307c",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            },
            {
              "lessThan": "4d1c3c26c2ab1842e139e61983395d64bd2e518b",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            },
            {
              "lessThan": "d6be8e59af412623e3d874be3a048406c0edfe60",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            },
            {
              "lessThan": "3f32d52ec604c659725d865cf8cc6a17a33f9c6a",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            },
            {
              "lessThan": "8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            },
            {
              "lessThan": "fb0707ce00eef4e2d60c3020e1c0432739703e4a",
              "status": "affected",
              "version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n\n[Why \u0026 How]\nThe VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and\nHdmi6GRegNum fields that are used as loop bounds when copying retimer I2C\nregister settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]\nand dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated\nbefore use, so a malformed VBIOS can specify values up to 255, causing an\nout-of-bounds heap write during driver probe.\n\nClamp each register count to the destination array size using min_t()\nbefore the copy loops, in both get_integrated_info_v11() and\nget_integrated_info_v2_1().\n\n(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T04:18:52.196Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a"
        }
      ],
      "title": "drm/amd/display: Clamp VBIOS HDMI retimer register count to array size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53136",
    "datePublished": "2026-06-25T08:38:25.097Z",
    "dateReserved": "2026-06-09T07:44:35.387Z",
    "dateUpdated": "2026-06-29T04:18:52.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53143 (GCVE-0-2026-53143)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-08-20 12:32

Title

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow. During CRIU checkpoint of an SDMA queue on Navi3x: - checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer, leaking 1536 bytes of adjacent GTT memory to userspace During CRIU restore: - restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer, corrupting 1536 bytes of adjacent GTT memory (often the ring buffer or neighboring MQDs) This is a copy-paste regression unique to v11. All other ASIC backends (cik, vi, v9, v10, v12) correctly use the SDMA-specific variants. Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly handle the smaller v11_sdma_mqd structure, matching the pattern used in other MQD managers. (cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-131 - Incorrect Calculation of Buffer Size

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/16dad1fb0d783a400…
https://git.kernel.org/stable/c/2c5b66c9b4057b385…
https://git.kernel.org/stable/c/d3efcadfe3eea5b42…
https://git.kernel.org/stable/c/d02f05d30f35b036f…
https://git.kernel.org/stable/c/352ea59028ea48a6f…
https://access.redhat.com/security/cve/CVE-2026-53143	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492719	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:57251	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57252	vendor-advisoryx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Linux	Linux	Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < 16dad1fb0d783a4008de30e32d0038c393de05b1 (git) Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < 2c5b66c9b4057b385566940935ebc32f6e6ebfd2 (git) Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64 (git) Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < d02f05d30f35b036f7cbaf72de634affb5b38ec6 (git) Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < 352ea59028ea48a6fff77f19ae28f98f71946a80 (git)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s AMD KFD (Kernel Fusion Driver) component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU (Checkpoint/Restore in User-space) operations on SDMA (System Direct Memory Access) queues. A local attacker can exploit this flaw during CRIU restore operations, which can lead to memory corruption in adjacent kernel memory, potentially impacting system stability or leading to further compromise. Additionally, during CRIU checkpoint operations, this vulnerability can result in information disclosure of adjacent kernel memory to userspace."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-131",
                "description": "Incorrect Calculation of Buffer Size",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T12:32:03.965Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53143"
          },
          {
            "name": "RHBZ#2492719",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492719"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53143.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57251"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57252"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:57251: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57252: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "16dad1fb0d783a4008de30e32d0038c393de05b1",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            },
            {
              "lessThan": "2c5b66c9b4057b385566940935ebc32f6e6ebfd2",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            },
            {
              "lessThan": "d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            },
            {
              "lessThan": "d02f05d30f35b036f7cbaf72de634affb5b38ec6",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            },
            {
              "lessThan": "352ea59028ea48a6fff77f19ae28f98f71946a80",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11\n\nThe v11 MQD manager incorrectly assigned the CP-compute variants of\ncheckpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions\nuse sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct\nv11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.\n\nDuring CRIU checkpoint of an SDMA queue on Navi3x:\n- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,\n  leaking 1536 bytes of adjacent GTT memory to userspace\n\nDuring CRIU restore:\n- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,\n  corrupting 1536 bytes of adjacent GTT memory (often the ring buffer\n  or neighboring MQDs)\n\nThis is a copy-paste regression unique to v11. All other ASIC backends\n(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.\n\nAdd checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly\nhandle the smaller v11_sdma_mqd structure, matching the pattern used in\nother MQD managers.\n\n(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:38:30.901Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64"
        },
        {
          "url": "https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6"
        },
        {
          "url": "https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"
        }
      ],
      "title": "drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53143",
    "datePublished": "2026-06-25T08:38:30.901Z",
    "dateReserved": "2026-06-09T07:44:35.387Z",
    "dateUpdated": "2026-08-20T12:32:03.965Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53329 (GCVE-0-2026-53329)

Vulnerability from cvelistv5 – Published: 2026-07-01 13:32 – Updated: 2026-08-05 12:35

Title

drm/amd/display: Use krealloc_array() in dal_vector_reserve()

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9540b0a4d13e4ede6…
https://git.kernel.org/stable/c/31180638a33acad12…
https://git.kernel.org/stable/c/b15825deac1acff72…
https://git.kernel.org/stable/c/201151e120f0062bc…
https://git.kernel.org/stable/c/a914aa802669e073f…
https://git.kernel.org/stable/c/e09689286385a6631…
https://git.kernel.org/stable/c/de988c7a31f0774f0…
https://git.kernel.org/stable/c/da48bc4461b8a5ebf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < 9540b0a4d13e4ede64ae1197d66a176d2149daa9 (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < 31180638a33acad12c863132704a76536fb66211 (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < b15825deac1acff72638bbc8f05b89ceef8dfb13 (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < 201151e120f0062bcda21cad5d007b82725ad23b (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < a914aa802669e073f014dae2e5708633b5cecd34 (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < e09689286385a66311ac6922af95339d7a3cef8d (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < de988c7a31f0774f07894cfe4802996f318e2870 (git) Affected: 2004f45ef83f07f43f5da6ede780b08068c7583d , < da48bc4461b8a5ebfb9264c9b191a701d8e99009 (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/basics/vector.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9540b0a4d13e4ede64ae1197d66a176d2149daa9",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "31180638a33acad12c863132704a76536fb66211",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "b15825deac1acff72638bbc8f05b89ceef8dfb13",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "201151e120f0062bcda21cad5d007b82725ad23b",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "a914aa802669e073f014dae2e5708633b5cecd34",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "e09689286385a66311ac6922af95339d7a3cef8d",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "de988c7a31f0774f07894cfe4802996f318e2870",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            },
            {
              "lessThan": "da48bc4461b8a5ebfb9264c9b191a701d8e99009",
              "status": "affected",
              "version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/basics/vector.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why \u0026 How]\ndal_vector_reserve() computes the allocation size as\n\"capacity * vector-\u003estruct_size\" using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The reachable kernel path is AMDGPU DRM display handling via local DRM connector probing or modeset operations; it is not network or namespace reachable. Physical hotplug can also reach related detection paths, but local DRM access is the higher-severity reasonable vector.\nAC:H - The overflow is deterministic once vector capacity crosses the uint32 multiplication limit, but the reachable DDC callers I found pass fixed tiny payload lengths and an attacker would need an unusual path causing enormous vector growth. That prerequisite is outside normal attacker control.\nPR:L - Triggering the relevant DRM display paths requires local access to the KMS device or DRM master-style display control, not real root in the init namespace. No user-namespace route or network-facing unauthenticated path reaches this code.\nUI:N - A local attacker who has the needed DRM access can trigger connector probing or modeset paths directly. No separate victim action is required.\nS:U - The corruption occurs inside the host kernel display driver and affects the same kernel security authority. There is no VM escape, IOMMU boundary bypass, or cross-scope component involved.\nC:H - The vulnerable allocation can leave the vector with a logical capacity larger than its actual heap buffer, and subsequent appends can corrupt adjacent kernel heap memory. Kernel heap corruption is reasonably leverageable for information disclosure.\nI:H - Subsequent vector appends perform out-of-bounds writes of controlled `struct i2c_payload` contents into adjacent kernel heap memory. That is kernel memory corruption and can plausibly support control-flow or data-integrity compromise.\nA:H - Even without full exploitation, the undersized allocation followed by appends can corrupt heap metadata or neighboring objects. That can cause kernel oops, panic, or display-driver crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:01.324Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9"
        },
        {
          "url": "https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211"
        },
        {
          "url": "https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13"
        },
        {
          "url": "https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34"
        },
        {
          "url": "https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870"
        },
        {
          "url": "https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009"
        }
      ],
      "title": "drm/amd/display: Use krealloc_array() in dal_vector_reserve()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53329",
    "datePublished": "2026-07-01T13:32:14.598Z",
    "dateReserved": "2026-06-09T07:44:35.398Z",
    "dateUpdated": "2026-08-05T12:35:01.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

alsa-2026:57251

Vulnerability from osv_almalinux

CVE-2026-43206 (GCVE-0-2026-43206)

CVE-2026-43237 (GCVE-0-2026-43237)

CVE-2026-43493 (GCVE-0-2026-43493)

CVE-2026-45878 (GCVE-0-2026-45878)

CVE-2026-45991 (GCVE-0-2026-45991)

CVE-2026-46185 (GCVE-0-2026-46185)

CVE-2026-52991 (GCVE-0-2026-52991)

CVE-2026-53136 (GCVE-0-2026-53136)

CVE-2026-53143 (GCVE-0-2026-53143)

CVE-2026-53329 (GCVE-0-2026-53329)

Tags

Sightings

Nomenclature

Related by attack behaviour