EUVD-2026-80408
GHSA-r66w-v4mr-3pxg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local GPU-device access (AV:L/PR:L); AC:H because it needs a racy hole condition plus non-zero stack garbage; effect is VRAM corruption/loss (I:H/A:H), no demonstrated confidentiality leak (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up.
Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0.
Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart.
AnalysisAI
Linux kernel AMD KFD (amdkfd) SVM migration code can use an uninitialized return value when migrating a VM range whose CPU side is a hole, causing the driver to tear down all VRAM pages it has just allocated and leaving memory state inconsistent. Affected are Linux kernel builds using the AMD GPU compute path (SVM/HMM migration to VRAM on ROCm/HSA-capable AMD hardware); the flaw affects code reachable from the commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 baseline and is fixed in 6.18.51, 7.2.5 and 7.3-rc1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to an AMD GPU exposing the KFD compute interface and the ability to drive SVM (Shared Virtual Memory) HMM migrations to VRAM - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk for what the description reveals to be an error-handling/reliability defect in the AMD KFD SVM migration path (svm_migrate_copy_to_vram). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor kernel fixes: update to Linux 6.18.51 or 7.2.5 (or 7.3-rc1 and later), or cherry-pick the stable commits ae806a95b28fcecb913430cfa45a252e91a945d6, 520e345ffe05aabef1db82beda4288afb1757ff2 and 0a9a0e8a97da70a0336c9115178aaf1be29bcfb1 from git.kernel.org; downstream distributions should track the corresponding stable release rather than backporting only the initialization line, since the patch also changes when the final svm_migrate_copy_memory_gart() flush occurs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux kernel versions across all hosts with ROCm/HSA-capable AMD GPUs, identify any system running a kernel at or below the affected baseline, and flag multi-tenant or shared GPU compute nodes as the top priority since the flaw is reachable only by a local user holding a GPU device handle; confirm whether the SVM/HMM VRAM migration path is actively exercised by current workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate
Share
External POC / Exploit Code
Leaving vuln.today