Skip to main content

Linux Kernel CVE-2026-53143

| EUVDEUVD-2026-39234 HIGH
Incorrect Calculation of Buffer Size (CWE-131)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-c92m-wmf9-qxfw
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local GPU-capable user (AV:L/PR:L), no interaction (UI:N); OOB read leaks kernel GTT memory and OOB write corrupts it, giving high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jul 08, 2026 - 15:00 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 08, 2026 - 15:00 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 08, 2026 - 14:52 vuln.today
cvss_changed
CVSS changed
Jul 08, 2026 - 14:52 NVD
7.0 (HIGH) 7.8 (HIGH)
Analysis Generated
Jun 30, 2026 - 05:30 vuln.today
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.0 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.0

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.

During CRIU checkpoint of an SDMA queue on Navi3x:

  • checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,

leaking 1536 bytes of adjacent GTT memory to userspace

During CRIU restore:

  • restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,

corrupting 1536 bytes of adjacent GTT memory (often the ring buffer or neighboring MQDs)

This is a copy-paste regression unique to v11. All other ASIC backends (cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.

Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly handle the smaller v11_sdma_mqd structure, matching the pattern used in other MQD managers.

(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)

AnalysisAI

Local information disclosure and memory corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs, where the v11 MQD manager wrongly used CP-compute checkpoint/restore handlers for SDMA queues. During a CRIU checkpoint or restore of an SDMA queue, the driver treats a 512-byte v11_sdma_mqd buffer as a 2048-byte v11_compute_mqd, so it either leaks 1536 bytes of adjacent GTT memory to userspace or overwrites 1536 bytes of neighboring GTT memory (ring buffers or adjacent MQDs). Exploitation requires local access with the ability to drive CRIU checkpoint/restore of a GPU compute process; there is no public exploit identified at time of analysis and EPSS is low (0.18%).

Technical ContextAI

The affected component is AMDGPU's Kernel Fusion Driver (amdkfd), which manages GPU compute queues via Memory Queue Descriptors (MQDs). Each queue type has its own MQD layout: compute queues use struct v11_compute_mqd (2048 bytes) and SDMA (System DMA / copy-engine) queues use struct v11_sdma_mqd (512 bytes). The v11 MQD manager (mqd_manager_v11, used on GFX11 hardware such as the Navi3x/RDNA3 family - Radeon RX 7000 series and comparable pro cards) mistakenly wired the CP-compute checkpoint_mqd/restore_mqd callbacks to KFD_MQD_TYPE_SDMA queues. When CRIU (Checkpoint/Restore In Userspace) snapshots or restores such a queue, the handler copies based on the larger compute size, reading or writing 1536 bytes past the end of the 512-byte SDMA MQD allocation in the GTT (Graphics Translation Table) aperture. This maps to CWE-131 (Incorrect Calculation of Buffer Size): the root cause is using sizeof(the wrong struct), a copy-paste regression unique to v11 - all other ASIC backends (cik, vi, v9, v10, v12) correctly use SDMA-specific variants.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.143, 6.12.94, 7.0.13, or 6.18.36 (or 7.1 mainline), whichever matches your branch - which adds dedicated checkpoint_mqd_sdma() and restore_mqd_sdma() functions that use the correct 512-byte v11_sdma_mqd size. The upstream fix is cherry-picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c; stable backports are at git.kernel.org (e.g. https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1 and related hashes 2c5b66c9, 352ea590, d02f05d3, d3efcadf). Track distro fixes via the Red Hat VEX/advisory (https://access.redhat.com/security/cve/CVE-2026-53143). If you cannot patch immediately, the practical compensating control is to prevent the vulnerable code path from being reached: disable or restrict CRIU checkpoint/restore of GPU compute processes on affected GFX11/Navi3x hosts (trade-off: breaks live-migration/snapshot workflows for GPU workloads), and restrict local access to trusted users on machines with Navi3x GPUs since exploitation requires a local low-privileged foothold. There is no network-facing mitigation because the vector is local only.

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu

CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V

CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-53143 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy