Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdkfd). The issue involves a missing validation check when a program requests information about hardware nodes. If exploited, this could lead to memory safety issues or system instability, potentially allowing a local user to disrupt operations or access restricted kernel information.
Technical details
A vulnerability exists in the Linux kernel's AMD GPU driver (amdkfd) within the kfd_ioctl_get_process_apertures_new function. The function failed to validate the 'num_of_nodes' argument against the actual number of available devices in the KFD topology. A local attacker could provide a large 'num_of_nodes' value, potentially leading to an out-of-bounds read or write relative to the memory allocated by the user-space process. The fix introduces a check using kfd_topology_get_num_devices() to ensure the requested node count does not exceed the system's hardware capacity. Patches have been released for multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.6.140, 6.12.90, 6.18.32, 7.0.9, 7.1
Timeline
- 2026-07-19: advisory: NVD publication date
- 2026-05-17: patched: Date of commit by Greg Kroah-Hartman in stable tree
References
- https://git.kernel.org/stable/c/44d5a450c04d3d734c13a03561c3131020d66edf
- https://git.kernel.org/stable/c/4a8093c7def141cc6e854fbe3f9693867982418f
- https://git.kernel.org/stable/c/6ba6ec5fcbb0d03ca11ed1cc38d57a7deb6c6b20
- https://git.kernel.org/stable/c/74b73fa56a395d46745e4f245225963e9f8be7f1
- https://git.kernel.org/stable/c/7b80137eb8aa9d1cbfe7ccf3eeb1faa94ae35d7e