Skip to main content

Linux Kernel CVE-2026-53329

| EUVDEUVD-2026-40963 HIGH
Uncontrolled Recursion (CWE-674)
2026-07-01 Linux GHSA-j7g7-x525-gxgj
Buffer Overflow Linux Amd
7.0
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local low-privileged account
  2. Delivery
    Open amdgpu DRM device
  3. Exploit
    Trigger oversized dal_vector reserve
  4. Install
    Wrap 32-bit size calculation
  5. C2
    Force undersized krealloc buffer
  6. Execute
    Overflow kernel heap on append
  7. Impact
    Corrupt memory for privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-674
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
Exploitation Conditions

Exploitation requires local access to a Linux system running a vulnerable kernel with the AMD display driver (amdgpu/drm-amd-display) loaded and an accessible DRM device - so the platform must have AMD graphics in use. The attacker needs at least low, authenticated local privileges (PR:L) sufficient to invoke the display code paths that call dal_vector_reserve(), and must be able to induce a vector reservation whose capacity × struct_size exceeds UINT32_MAX to trigger the overflow. Limiting factors are significant: it is not remotely exploitable (AV:L), requires an existing local account, only affects systems with the amdgpu display stack, and carries high attack complexity (AC:H) because arranging an allocation large enough to wrap a 32-bit product is difficult in practice. No user interaction is required (UI:N).
Impact

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a consistent story: exploitation is local (AV:L), requires at least low privileges/an authenticated local user (PR:L), and has high attack complexity (AC:H) because driving the 32-bit multiplication to wrap requires an enormous, difficult-to-arrange capacity value - a strong practical limiter. If achieved, the heap corruption carries high confidentiality, integrity and availability impact within the kernel, hence the High rating. Corroborating real-world signals point to low urgency: EPSS is 0.19% (9th percentile), the CVE is not on CISA KEV, and no public proof-of-concept is known. This is a defense-in-depth hardening fix typical of the automated Linux CVE stream rather than an actively exploited threat. No data conflicts are apparent, though the CWE field is marked N/A in the input; based on the description the root cause is integer overflow (CWE-190) leading to heap overflow (CWE-122). Priority should track normal kernel patch cadence, not emergency response.
Exploit ScenarioDerived

A local user who already has a shell on a machine with an AMD GPU opens the amdgpu DRM device and issues operations that drive a dal_vector to request a capacity large enough that capacity × struct_size wraps the 32-bit size calculation. krealloc() returns an undersized heap buffer, and subsequent vector appends write out of bounds, corrupting adjacent kernel heap objects in a bid to escalate privileges. No public proof-of-concept is known, and the high attack complexity makes reliable exploitation difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 18, 2026

Heap overflow in the Linux kernel's AMD GPU display driver (drm/amd/display) arises because dal_vector_reserve() computes its allocation size as "capacity * struct_size" in 32-bit arithmetic, which can silently wrap to a small value and cause krealloc() to return an undersized buffer. A local, low-privileged user with access to the DRM/amdgpu device can trigger out-of-bounds heap writes on subsequent vector appends, potentially corrupting kernel memory. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile); the issue is fixed and rated CVSS 7.0 (High).

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel: 5.15.210, 6.1.176, 6.6.143, 6.12.94, 7.0.13, or 6.18.36 (fix also in mainline 7.1) - select the point release matching your maintained branch and reboot into it. Distribution users should install the corresponding vendor kernel update once it incorporates these stable commits (see kernel.org stable references, e.g. https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211, and the NVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-53329). Where immediate patching is not possible, the practical compensating control is to restrict local access to systems with AMD GPUs and limit which users can open the amdgpu DRM render/display nodes, since exploitation requires local low-privileged access to that driver; on systems that do not need AMD graphics, avoiding or unloading the amdgpu module removes the code path entirely, at the cost of losing AMD GPU acceleration/display support. There is no remote exposure to mitigate, so network-layer controls do not apply.

Affected VersionsENISA

Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <a914aa802669e073f014dae2e5708633b5cecd34
Linux patch: 6.6.143
Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <b15825deac1acff72638bbc8f05b89ceef8dfb13
Linux patch: 6.1.176
Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <da48bc4461b8a5ebfb9264c9b191a701d8e99009
Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <e09689286385a66311ac6922af95339d7a3cef8d
Linux patch: 7.1
Linux patch: 5.15.210
Linux patch: 7.0.13
Linux patch: 6.12.94
Linux 4.15
Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <201151e120f0062bcda21cad5d007b82725ad23b
Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <de988c7a31f0774f07894cfe4802996f318e2870
Linux 2004f45ef83f07f43f5da6ede780b08068c7583d <31180638a33acad12c863132704a76536fb66211
Linux patch: 0
Linux patch: 6.18.36

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Display Abstraction Layer (DAL) inside AMD's Direct Rendering Manager display driver (drm/amd/display) in the Linux kernel. The dal_vector container grows its backing store via dal_vector_reserve(), which multiplied the requested capacity by the per-element struct_size using uint32_t arithmetic. When that product exceeds UINT32_MAX it wraps to a small number, so krealloc() allocates far less memory than the vector believes it has, and later element writes run past the allocation - a classic integer-overflow-leading-to-heap-buffer-overflow (CWE-190 feeding CWE-122). The CPE data identifies the affected product as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, specifically builds that include the amdgpu display stack. The fix replaces krealloc() with krealloc_array(), which performs an internal size-multiplication overflow check and returns NULL instead of an undersized buffer; the change was cherry-picked from upstream commit 37668568641c.

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local access to the amdgpu DRM device and a low-priv account (PR:L, AV:L); triggering a 32-bit multiply overflow is impractical (AC:H); kernel heap corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 18, 2026 - 08:22 NVD
7.0 (HIGH)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 cve.org
HIGH 7.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Use krealloc_array() in dal_vector_reserve()

[Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends.

Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue.

(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)

Executive ViewAI

Why It Matters

A heap overflow in Linux kernel AMD GPU display drivers (CVE-2026-53329) enables local privilege escalation through kernel memory corruption; exploitation likelihood is low (EPSS 0.2%) and no public exploit identified at time of analysis. A vendor patch is available. Organizations running AMD GPUs should prioritize kernel updates to eliminate this local attack surface.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Prevalence
Ubiquitous
Linux kernel with AMD display driver runs on vast numbers of systems
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-66393 HIGH POC
8.7
CVE-2026-18140 HIGH POC
8.7
CVE-2026-93687 HIGH POC
8.7
CVE-2026-9769 HIGH POC
8.7

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53329 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/375494 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b REF https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211 REF https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9 REF https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34 REF https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13 REF https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009 REF https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870 REF https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy