Skip to main content

Linux Kernel EUVDEUVD-2026-32856

| CVE-2026-46229 MEDIUM
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-w77m-3j47-48fr
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.1 MEDIUM

Local PR:L access required; C:L added over official C:N because description explicitly states stale VRAM data is observable by compute kernels.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 10, 2026 - 21:40 vuln.today
CVSS changed
Jun 10, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure

KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated VRAM with stale data from prior use observable by compute kernels.

The GEM ioctl path already sets VRAM_CLEARED for all userspace allocations via amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). The KFD path was missing this flag, allowing stale page table remnants to leak into user buffers.

This causes crashes in RCCL P2P transport where non-zero data in ptrExchange/head/tail fields corrupts the protocol handshake.

AnalysisAI

Stale VRAM exposure in the Linux kernel's amdkfd driver (drm/amdkfd) allows local authenticated users to observe prior occupants' GPU memory contents and crash multi-GPU compute workloads. The KFD allocation path omitted the AMDGPU_GEM_CREATE_VRAM_CLEARED flag - present in every other userspace GEM allocation path - leaving freshly allocated VRAM buffers populated with data from previous processes. The primary documented availability impact is deterministic crashes in RCCL peer-to-peer transport when stale values corrupt the ptrExchange, head, and tail protocol fields; a secondary information-disclosure risk exists because stale page-table remnants are observable by unprivileged compute kernels. No public exploit identified at time of analysis; EPSS is 0.02% (5th percentile).

Technical ContextAI

The AMD Kernel Fusion Driver (amdkfd) is the Linux kernel subsystem that manages GPU compute access for ROCm workloads, exposing VRAM through the GEM (Graphics Execution Manager) object model. Two GEM creation flags govern memory hygiene: AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE (zeroes pages on free, preventing cross-process leakage after deallocation) and AMDGPU_GEM_CREATE_VRAM_CLEARED (zeroes pages on allocation, preventing a newly allocated buffer from containing data from its previous owner). The GEM ioctl path in amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create() correctly sets VRAM_CLEARED. The KFD allocation path, however, set only VRAM_WIPE_ON_RELEASE, meaning a process allocating VRAM via the KFD interface receives pages whose contents reflect a prior tenant. Affected CPE: cpe:2.3:o:linux:linux_kernel across all stable branches from the initial GEM commit (1da177e4c3f4) through the fix commits listed. The root-cause weakness is uninitialized memory reuse - analogous to CWE-908 (Use of Uninitialized Resource) - rather than a memory-safety bug, but the impact is both availability degradation and potential information disclosure.

RemediationAI

Upgrade to a patched Linux kernel stable release: 6.6.140, 6.12.90, 7.0.9, or 6.18.32 as appropriate for your distribution's kernel series. The 7.1-rc1 mainline also contains the fix. Commit references are available at the five git.kernel.org/stable/c/ links in the NVD references. Distribution vendors (RHEL, SUSE, Ubuntu, Debian) are expected to backport these commits into their kernel packages; consult the respective distribution security advisories. If an immediate kernel upgrade is not feasible, the most effective compensating control is to unload or blacklist the amdkfd kernel module (modprobe -r amdkfd; echo 'blacklist amdkfd' >> /etc/modprobe.d/amdkfd-disable.conf), which eliminates the vulnerable allocation path entirely but disables all ROCm and GPU compute functionality. Restricting access to the /dev/kfd device node to a dedicated group (chmod 660 /dev/kfd; chown root:render /dev/kfd) limits exposure to only those users requiring GPU compute access, reducing the privilege-escalation surface without fully disabling compute. There is no vendor advisory URL beyond the NVD entry and EUVD-2026-32856 at time of analysis.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-32856 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy