Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdkfd) that could allow a local user to cause a system crash or potentially access restricted memory. The issue occurs when the system processes specific debug commands for graphics hardware without properly verifying the input range. This could lead to operational instability or unauthorized data access on systems using affected AMD graphics hardware.
Technical details
A buffer overflow vulnerability exists in `drivers/gpu/drm/amd/amdkfd/kfd_debug.c` within the Linux kernel. The `kfd_dbg_trap_clear_dev_address_watch` and `kfd_dbg_trap_set_dev_address_watch` functions receive a `watch_id` as a `u32` from userspace. However, internal helper functions like `kfd_dbg_owns_dev_watch_id` previously used signed integers or failed to perform adequate bounds checking against `MAX_WATCH_ADDRESSES`. An attacker providing a large `watch_id` could trigger an out-of-bounds memory access or an undefined bit shift, potentially leading to local privilege escalation or a kernel panic. The fix introduces explicit bounds checking and uses the `BIT()` macro for safe bitwise operations.
Affected products
- Linux Linux kernel e0f85f4690d0
Timeline
- 2026-02-06: other: Patch authored by Srinivasan Shanmugam
- 2026-05-27: advisory: CVE-2026-45878 published
References
- https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150
- https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd
- https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742
- https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6
- https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488