Linux Kernel CVE-2026-80747

Exploitation requires a host system with AMD KFD-capable GPU or APU hardware with the amdkfd kernel module loaded and active. The attacker must be able to cause the CRAT parser to process a malformed table - this occurs either at driver initialization (amdkfd module load/device probe) with a firmware-supplied malformed CRAT, or if a user-space code path exists to re-trigger CRAT parsing. PR:N in the vendor CVSS implies unprivileged local user exploitation is claimed, but this is not explicitly confirmed by the description; in practice, triggering CRAT reparsing may require at minimum an open /dev/kfd file descriptor (typically accessible to users in the 'render' or 'video' group on Linux desktop systems). Systems without AMD GPU hardware, or with amdkfd blacklisted, are entirely unexposed. The vulnerability does not affect network-facing code paths.

The vendor-supplied CVSS vector (AV:L/AC:L/PR:N/UI:N/C:H/I:L/A:H) yields 8.0, but several metrics warrant scrutiny. AV:L (local) is appropriate since exploiting the CRAT parser requires reaching the KFD initialization or reparsing path on the host. PR:N is the most debatable metric: triggering this path typically requires either firmware-level CRAT table manipulation (which implies elevated or physical access) or a user-space mechanism to supply/override CRAT data - the PR:N claim is not fully supported by the description alone and may overstate accessibility. I:L is weakly justified for an OOB read; the realistic write impact is near-zero absent a separate exploitation primitive. EPSS of 0.19% (9th percentile) aligns with low real-world exploitation interest. The vulnerability is not listed in CISA KEV and no public exploit code exists. Real-world priority is moderate: systems running amdkfd with AMD APU/GPU hardware should patch promptly, but the limited exploit surface (local, hardware-specific driver path) substantially reduces urgency compared to the raw CVSS score. CVSS C:H (kernel memory disclosure) is the most credible impact signal.

A local attacker with access to an AMD GPU/APU system manipulates or supplies a crafted CRAT table with an oversized subtype length field - either through a firmware interface, physical access, or a user-space KFD ioctl path that triggers CRAT reparsing. When the kernel's kfd_parse_subtype() casts the header pointer into a larger subtype structure, it reads beyond the allocated buffer, potentially disclosing adjacent kernel memory contents or triggering a kernel panic. No public proof-of-concept code exists at time of analysis.