Executive brief
A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to access sensitive system memory or cause system instability. The issue occurs when the system saves or restores the state of certain graphics processing queues on GFX11 (Navi 3x) hardware. This could lead to the exposure of private data to unauthorized users or cause the system to crash or behave unpredictably.
Technical details
A buffer overflow exists in the 'drm/amdkfd' driver within the Linux kernel, specifically affecting GFX11 (Navi 3x) hardware. The v11 MQD (Memory Queue Descriptor) manager incorrectly used CP-compute variants of checkpoint/restore functions for SDMA queues. This resulted in the driver reading or writing 2048 bytes (the size of a compute MQD) into a 512-byte buffer (the size of an SDMA MQD). During a CRIU (Checkpoint/Restore In Userspace) checkpoint, this leads to a 1536-byte out-of-bounds read, leaking adjacent GTT memory to userspace. During a restore, it causes a 1536-byte out-of-bounds write, corrupting adjacent GTT memory such as ring buffers or neighboring MQDs. The issue has been resolved by implementing SDMA-specific checkpoint and restore functions.
Affected products
- Linux Linux 5.19 to 6.18.36
Timeline
- 2026-05-28: other: Vulnerability fixed in source code
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1
- https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2
- https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80
- https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6
- https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64