Skip to main content

Linux Kernel CVE-2026-68257

| EUVDEUVD-2026-55358 HIGH
2026-08-10 Linux GHSA-rqrw-7v4f-gfw3
Buffer Overflow Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local exploitation requires /dev/kfd device access at low privilege; kernel heap overrun from firmware write enables full system compromise with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:25 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:01 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns.

Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers().

(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)

AnalysisAI

Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.

Technical ContextAI

The drm/amdkfd driver implements the AMD Kernel Fusion Driver interface for GPU compute workloads. Compute Wave Save/Restore (CWSR) is a GPU preemption mechanism that saves and restores compute wave state during context switches. In affected versions, the variable total_cwsr_size in kfd_queue_acquire_buffers() and kfd_queue_release_buffers() was declared as a 32-bit integer type. When computing total buffer size by multiplying ctx_save_restore_area_size and debug_memory_size by the XCC (Compute Die) count - which reaches 8 or more on AMD MI300-class GPUs - the 32-bit arithmetic wraps around, producing a value far smaller than the actual required allocation. The resulting BO (Buffer Object) or SVM (Shared Virtual Memory) allocation is undersized, and AMD firmware subsequently overwrites adjacent kernel heap memory when writing CWSR state. The fix promotes total_cwsr_size to u64 and applies Linux's check_add_overflow()/check_mul_overflow() helpers. CPE: cpe:2.3:a:linux:linux. Although CWE is not explicitly assigned, the root cause class aligns with CWE-190 (Integer Overflow or Wraparound) leading to CWE-122 (Heap-based Buffer Overflow).

RemediationAI

Vendor-released patches are available. Upgrade to Linux kernel 6.12.101, 6.18.42, or 7.1.6 depending on the stable branch in use; mainline users should target 7.2-rc4 or later. Patch commits are confirmed at https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e (6.12 branch), https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b (6.18 branch), and https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467 and https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849 for additional branches. If immediate kernel upgrade is not feasible, restrict access to /dev/kfd and /dev/dri/renderD* device nodes via udev rules or device group membership to only trusted users and service accounts, preventing untrusted local users from reaching the vulnerable CWSR allocation path; trade-off is that this denies GPU compute access to those users, making it unsuitable for shared compute environments. As a more aggressive workaround, systems that do not require AMD GPU compute can blacklist the amdkfd module (add 'blacklist amdkfd' to /etc/modprobe.d/blacklist.conf and rebuild initramfs), which disables AMD GPU compute functionality entirely but removes the attack surface completely.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68257 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy