What is the CVSS score of CVE-2026-68447?

CVE-2026-68447 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 15.0%.

Which versions of Linux Kernel are affected by CVE-2026-68447?

A Linux kernel vulnerability in AMD GPU driver code enables local memory disclosure on v9 hardware systems; no public exploit has been identified.. A patch is available.

How to fix or mitigate CVE-2026-68447?

Within 24 hours, inventory all Linux systems with AMD v9 GPUs by identifying the drm/amdkfd kernel module and AMD GPU hardware present. Within 7 days, obtain and test the available vendor patch through your Linux distribution's update repositories, deploying to a test environment to validate GPU compute queue functionality remains intact before production rollout. Within 30 days, complete production deployment across all affected systems, confirm patch installation via kernel version verification, and update your GPU infrastructure security baseline.

Linux Kernel CVE-2026-68447

EUVD-2026-57053 HIGH

2026-08-12 Linux

GHSA-m433-x9mx-qcj6

Information Disclosure Linux Checkpoint

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

6.1 MEDIUM

Local /dev/kfd device access with low privilege required (AV:L/PR:L); primary impact is kernel data leakage, with limited rather than high availability risk per description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 01:48 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.1 (HIGH)

Patch available

Aug 12, 2026 - 02:01 EUVD

CVE Published

Aug 12, 2026 - 00:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 00:51 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace.

Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout.

(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)

AnalysisAI

Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local low-privilege access with /dev/kfd permission

Delivery

Create AMD GPU compute queue via AMDKFD ioctl

Exploit

Trigger CRIU checkpoint on active queue

Execution

Hardware cp_hqd_cntl_stack_size exceeds BO allocation

Persist

Kernel memcpy reads past BO into adjacent GTT memory

Impact

Adjacent kernel data returned to userspace checkpoint buffer

Access

Gain local low-privilege access with /dev/kfd permission

Delivery

Create AMD GPU compute queue via AMDKFD ioctl

Exploit

Trigger CRIU checkpoint on active queue

Execution

Hardware cp_hqd_cntl_stack_size exceeds BO allocation

Persist

Kernel memcpy reads past BO into adjacent GTT memory

Impact

Adjacent kernel data returned to userspace checkpoint buffer

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) AMD v9 architecture GPU hardware present and the amdkfd kernel module loaded (e.g., AMD Vega, CDNA, or Instinct MI300/multi-XCC v9.4.3); (2) local access with at least low privilege (PR:L per CVSS vector), specifically membership in the OS group permitted to open /dev/kfd (typically 'video' or 'render'); (3) ability to create an AMD GPU compute queue and invoke the CRIU checkpoint ioctl path, which is a non-default, GPU-process-migration-specific workflow rather than ordinary GPU rendering or compute use; (4) a hardware-reported cp_hqd_cntl_stack_size that exceeds the allocated BO size, which may be hardware-model-specific. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) scores 7.1 and assigns high availability impact, which is not clearly supported by the description - the described impact is a kernel data leak, not a crash or denial-of-service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with membership in the 'video' or 'render' group on a system running AMD v9 GPU hardware creates a compute queue via the AMDKFD ioctl interface and triggers a CRIU checkpoint operation on that queue. The hardware-reported cp_hqd_cntl_stack_size is larger than the queue's allocated control stack BO, causing the kernel's memcpy to read beyond the BO boundary into adjacent GTT memory. …
Remediation	The primary remediation is to upgrade the Linux kernel to version 7.1.6 (stable series) or apply mainline commit 426ffae6ecc7ec77d32bf8be065c21a1b881b084 for the 7.2-rc2 and later mainline track; patch links are available at https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9 (7.1.x) and https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084 (mainline). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux systems with AMD v9 GPUs by identifying the drm/amdkfd kernel module and AMD GPU hardware present. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Checkpoint

View all

CVE-2024-24919 HIGH Act Now POC

8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2017-1000083 HIGH Act Now POC

7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL Emergency POC

9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2024-3568 CRITICAL Act Now POC

9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH This Week POC

8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH This Week POC

8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH This Week POC

8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

CVE-2019-8461 HIGH This Week POC

7.8 Aug 29

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo

CVE-2019-8452 HIGH This Week POC

7.8 Apr 22

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien

CVE-2026-69112 MEDIUM This Month POC

6.9 Aug 10

Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte

CVE-2013-7350 CRITICAL Act Now

10.0 Apr 01

Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef

CVE-2026-31214 CRITICAL Act Now

9.8 May 12

Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to exec

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-68447 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68447

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Checkpoint

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code