Executive brief
The AMD GPU kernel driver (amdkfd) parses CRAT tables to configure GPU hardware. A malformed CRAT table with an oversized length field can trigger out-of-bounds memory reads, potentially exposing sensitive kernel data or causing a system crash. This vulnerability affects systems with AMD GPUs running vulnerable kernel versions.
Technical details
The vulnerability is a bounds check bypass (CWE-119) in the CRAT table parser within drivers/gpu/drm/amd/amdkfd/kfd_crat.c. The parser validated only that the subtype header structure itself fits within the image boundary, but failed to validate that the advertised subtype length field does not extend beyond the image boundary. When kfd_parse_subtype() casts the header to specific subtype structures, an oversized length causes out-of-bounds reads. The fix adds validation that (sub_type_hdr + length) does not exceed the image boundary before parsing subtype contents. Attack vector is local (requires ability to provide malformed CRAT table) or requires privileged access to system firmware/configuration.
Affected products
- Linux kernel Multiple kernel versions including 5.x, 6.x series and later
Timeline
- 2026-09-03: disclosed: CVE-2026-80747 published on NVD
- 2026-07-06: patched: Fix committed upstream (commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
- 2026-08-15: patched: Backported to stable kernel series (commit ca91e0cc8087568e4b791648a7c01e804f48cb73)