Skip to main content

Linux Kernel EUVDEUVD-2026-39234

| CVE-2026-53143 HIGH
Incorrect Calculation of Buffer Size (CWE-131)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-c92m-wmf9-qxfw
Buffer Overflow Linux Checkpoint
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-privileged shell on Navi3x host
  2. Delivery
    Launch GPU compute process creating SDMA queue
  3. Exploit
    Invoke CRIU checkpoint/restore on the queue
  4. Execution
    Trigger oversized copy against 512-byte MQD
  5. Persist
    Read adjacent GTT memory or corrupt neighboring buffers
  6. Impact
    Leak kernel data or cause DoS

Vulnerability Assessment

Weakness
CWE
CWE-131
ASVS 5.0
V15 - Secure Coding and Architecture Buffer size calculation
Exploitation Conditions

Exploitation requires local access to a host with an AMD GFX11/Navi3x (RDNA3) GPU and the ability to run a GPU compute workload that creates a KFD_MQD_TYPE_SDMA queue, then to trigger a CRIU checkpoint (for the 1536-byte GTT memory-disclosure read) or a CRIU restore of an attacker-influenced image (for the 1536-byte GTT out-of-bounds write). The exact prerequisite feature is the amdkfd MQD checkpoint/restore path exercised via CRIU on SDMA queues on the v11 MQD manager. Limiting factors: the flaw is local only (CVSS PR:L means the attacker must be an authenticated local user, no remote path), it is hardware-specific to GFX11/Navi3x (other ASIC backends cik/vi/v9/v10/v12 are unaffected), and it depends on the CRIU checkpoint/restore functionality being available and used against GPU processes - hosts without CRIU-based GPU checkpointing are not reachable through this path.
Impact

This is a genuine memory-safety bug but a modest real-world priority. The CVSS 3.1 base is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N - it is strictly local, requires low privileges (an authenticated local user able to run a GPU compute workload under CRIU), needs no user interaction, and yields high confidentiality, integrity and availability impact via the out-of-bounds read (kernel/GTT memory disclosure) and out-of-bounds write (GTT corruption). Corroborating signals lower the urgency: EPSS is only 0.18% (8th percentile), it is not on CISA KEV, and no public exploit is identified. The AV:L/PR:L requirement means an attacker already needs a foothold on the host with GPU access, and exploitation is further gated on the fairly specialized CRIU checkpoint/restore path for SDMA queues on GFX11 hardware. Note a scope nuance: while the CVSS marks S:U, the OOB read leaks adjacent kernel-managed GTT memory to userspace, which is a meaningful confidentiality boundary crossing in practice. Overall this is a legitimate high-CVSS local flaw but low likelihood of opportunistic mass exploitation - patch on a normal maintenance cadence rather than as an emergency.
Exploit ScenarioDerived

A local low-privileged user on a workstation or GPU node fitted with a Navi3x/RDNA3 card starts a compute process that creates an SDMA queue, then invokes a CRIU checkpoint; the driver reads 2048 bytes from the 512-byte MQD and returns 1536 bytes of adjacent GTT memory into the userspace checkpoint image, disclosing kernel-managed data. Conversely, crafting a CRIU restore image causes restore_mqd() to write 2048 bytes into the 512-byte buffer, corrupting neighboring ring buffers or MQDs for a denial of service or potential further manipulation. No public exploit is identified at time of analysis, and the local, low-complexity vector (AV:L/AC:L) means exploitation is reliable once an attacker has GPU-capable local access.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 08, 2026

Local information disclosure and memory corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs, where the v11 MQD manager wrongly used CP-compute checkpoint/restore handlers for SDMA queues. During a CRIU checkpoint or restore of an SDMA queue, the driver treats a 512-byte v11_sdma_mqd buffer as a 2048-byte v11_compute_mqd, so it either leaks 1536 bytes of adjacent GTT memory to userspace or overwrites 1536 bytes of neighboring GTT memory (ring buffers or adjacent MQDs). Exploitation requires local access with the ability to drive CRIU checkpoint/restore of a GPU compute process; there is no public exploit identified at time of analysis and EPSS is low (0.18%).

Earlier versions of this analysis (2)
v2 Jul 08, 2026 - 15:00 cvss changed CVSS 7.8

Local memory disclosure and corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs during CRIU checkpoint and restore of SDMA queues. Because the v11 MQD manager wrongly wired the CP-compute checkpoint_mqd/restore_mqd handlers (which assume a 2048-byte v11_compute_mqd) to KFD_MQD_TYPE_SDMA queues that actually use a 512-byte v11_sdma_mqd, checkpointing leaks 1536 bytes of adjacent GTT memory to userspace and restoring overwrites 1536 bytes of neighboring GTT (ring buffers or adjacent MQDs). No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile).

v1 Jun 30, 2026 - 05:30 CVSS 7.0

Kernel memory disclosure and corruption in the Linux amdkfd (AMD KFD/amdgpu) driver affects GFX11/Navi3x GPUs when CRIU checkpoint/restore is performed on SDMA queues. The v11 MQD manager mistakenly wired the CP-compute checkpoint/restore handlers (sized for the 2048-byte v11_compute_mqd) to SDMA queues whose MQD buffer is only 512 bytes, so checkpoint leaks 1536 bytes of adjacent GTT memory to userspace and restore overwrites 1536 bytes of neighboring GTT (ring buffers or other MQDs). A vendor patch is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.143, 6.12.94, 7.0.13, or 6.18.36 (or 7.1 mainline), whichever matches your branch - which adds dedicated checkpoint_mqd_sdma() and restore_mqd_sdma() functions that use the correct 512-byte v11_sdma_mqd size. The upstream fix is cherry-picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c; stable backports are at git.kernel.org (e.g. https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1 and related hashes 2c5b66c9, 352ea590, d02f05d3, d3efcadf). Track distro fixes via the Red Hat VEX/advisory (https://access.redhat.com/security/cve/CVE-2026-53143). If you cannot patch immediately, the practical compensating control is to prevent the vulnerable code path from being reached: disable or restrict CRIU checkpoint/restore of GPU compute processes on affected GFX11/Navi3x hosts (trade-off: breaks live-migration/snapshot workflows for GPU workloads), and restrict local access to trusted users on machines with Navi3x GPUs since exploitation requires a local low-privileged foothold. There is no network-facing mitigation because the vector is local only.

Affected VersionsENISA

Linux patch: 6.6.143
Linux cc009e613de6560eb499f8bc92c80a737752cb30 <2c5b66c9b4057b385566940935ebc32f6e6ebfd2
Linux patch: 7.1
Linux cc009e613de6560eb499f8bc92c80a737752cb30 <d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64
Linux cc009e613de6560eb499f8bc92c80a737752cb30 <352ea59028ea48a6fff77f19ae28f98f71946a80
Linux patch: 0
Linux 5.19
Linux cc009e613de6560eb499f8bc92c80a737752cb30 <16dad1fb0d783a4008de30e32d0038c393de05b1
Linux patch: 7.0.13
Linux patch: 6.12.94
Linux patch: 6.18.36
Linux cc009e613de6560eb499f8bc92c80a737752cb30 <d02f05d30f35b036f7cbaf72de634affb5b38ec6

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is AMDGPU's Kernel Fusion Driver (amdkfd), which manages GPU compute queues via Memory Queue Descriptors (MQDs). Each queue type has its own MQD layout: compute queues use struct v11_compute_mqd (2048 bytes) and SDMA (System DMA / copy-engine) queues use struct v11_sdma_mqd (512 bytes). The v11 MQD manager (mqd_manager_v11, used on GFX11 hardware such as the Navi3x/RDNA3 family - Radeon RX 7000 series and comparable pro cards) mistakenly wired the CP-compute checkpoint_mqd/restore_mqd callbacks to KFD_MQD_TYPE_SDMA queues. When CRIU (Checkpoint/Restore In Userspace) snapshots or restores such a queue, the handler copies based on the larger compute size, reading or writing 1536 bytes past the end of the 512-byte SDMA MQD allocation in the GTT (Graphics Translation Table) aperture. This maps to CWE-131 (Incorrect Calculation of Buffer Size): the root cause is using sizeof(the wrong struct), a copy-paste regression unique to v11 - all other ASIC backends (cik, vi, v9, v10, v12) correctly use SDMA-specific variants.

Know when Checkpoint gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local GPU-capable user (AV:L/PR:L), no interaction (UI:N); OOB read leaks kernel GTT memory and OOB write corrupts it, giving high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 08, 2026 - 15:00 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 08, 2026 - 15:00 vuln.today
v2 - CVSS changed
CVSS changed
Jul 08, 2026 - 14:52 NVD
7.0 (HIGH) 7.8 (HIGH)
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.0 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.0

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.

During CRIU checkpoint of an SDMA queue on Navi3x:

  • checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,

leaking 1536 bytes of adjacent GTT memory to userspace

During CRIU restore:

  • restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,

corrupting 1536 bytes of adjacent GTT memory (often the ring buffer or neighboring MQDs)

This is a copy-paste regression unique to v11. All other ASIC backends (cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.

Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly handle the smaller v11_sdma_mqd structure, matching the pattern used in other MQD managers.

(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)

Executive ViewAI

Why It Matters

A memory corruption vulnerability in the Linux kernel's AMD GPU driver (CVE-2026-53143) can disclose sensitive data from GPU memory and corrupt adjacent memory regions on systems with GFX11/Navi3x graphics processors. Exploitation requires local system access with no public exploit identified at time of analysis; organizations should prioritize patching systems used for sensitive workloads.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous; but amdkfd/GFX11 GPU subset is narrower
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Checkpoint

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
CVE-2026-93616 CRITICAL POC
9.8 Sep 22

Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
CVE-2021-3449 MEDIUM
5.9 Mar 25

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
CVE-2026-91843 CRITICAL POC
9.8 Sep 16

Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

Same weakness CWE-131 – Incorrect Calculation of Buffer Size

View all
CVE-2024-23606 CRITICAL POC
9.8
CVE-2021-21824 CRITICAL POC
9.8
CVE-2025-66216 CRITICAL POC
9.3
CVE-2021-21793 HIGH POC
8.8
CVE-2021-21782 HIGH POC
8.8
CVE-2021-21776 HIGH POC
8.8
CVE-2023-0568 HIGH POC
8.1
CVE-2021-29608 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53143 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373684 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://access.redhat.com/errata/RHSA-2026:57251 REF https://access.redhat.com/errata/RHSA-2026:57252 REF https://access.redhat.com/security/cve/CVE-2026-53143 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492719 REF https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1 REF https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2 REF https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80 REF https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6 REF https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53143.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy