Executive brief
A vulnerability exists in the Linux kernel's AMD GPU driver (amdkfd) specifically within its debugger component. On 32-bit systems, a mathematical error could allow a local user to trigger an integer overflow when managing hardware queues. This could potentially lead to system instability or unauthorized memory access, impacting the reliability of systems using AMD graphics hardware.
Technical details
An integer overflow vulnerability exists in the get_queue_ids() function within drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c. The function calculates array_size by multiplying num_queues by sizeof(uint32_t), which can overflow on 32-bit builds where size_t is 32 bits. This overflowed value is subsequently passed to memdup_user(), potentially leading to a heap-based buffer overflow or out-of-bounds memory access. The fix introduces a check against KFD_MAX_NUM_OF_QUEUES_PER_PROCESS and utilizes the array_size() helper to ensure the calculation saturates to SIZE_MAX on overflow. Patches have been backported to multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1
Timeline
- 2026-05-12: other: Vulnerability fixed in internal AMD tree
- 2026-07-19: disclosed: CVE published and patches merged into stable kernel trees
References
- https://git.kernel.org/stable/c/4e5f808b454167cc58d7084a407a554d8ddc694d
- https://git.kernel.org/stable/c/4f9eeedc3d3151f8a226fd676c314a813edda5a1
- https://git.kernel.org/stable/c/5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c
- https://git.kernel.org/stable/c/93f5534b35a05ef8a0109c1eefa800062fee810a
- https://git.kernel.org/stable/c/de70a80992396ee306ee3a2810ad28aa1608ba9b