Junglewise Threat Intelligence

CVE-2026-43206: Linux Kernel amdkfd out-of-bounds write in kfd_event_page_set

CVE-2026-43206 · Severity: high · CVSS 7.8 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to gain elevated privileges on a system. The issue occurs when the system handles specific graphics event pages without properly verifying the size of the memory buffer provided by an application. An attacker could exploit this to overwrite sensitive kernel memory, potentially taking full control of the operating system.

Technical details

An out-of-bounds write vulnerability exists in the Linux kernel's 'amdkfd' driver within the kfd_event_page_set() function. The function uses memset to write a fixed amount of data (KFD_SIGNAL_EVENT_LIMIT * 8 bytes) to a buffer without first validating that the buffer size provided by userspace is sufficient. A local, unprivileged attacker can exploit this by passing a smaller-than-expected buffer, triggering a kernel memory corruption. This can be leveraged to achieve arbitrary code execution in kernel mode or local privilege escalation (LPE). The issue has been addressed by adding a size check to ensure the event page meets the minimum required length.

Affected products

  • Linux Linux Kernel 4.17 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-02-02: other: Patch authored by Sunday Clement
  • 2026-05-06: disclosed: CVE published by kernel.org
  • 2026-05-06: advisory: NVD advisory published

References

Related threats