Skip to main content

Linux Kernel EUVDEUVD-2026-55359

| CVE-2026-68258 HIGH
2026-08-10 Linux GHSA-vj59-w4c8-vwfg
Information Disclosure Linux Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local access with low privileges required to reach KFD CRIU ioctl; high confidentiality from kernel memory disclosure and high availability from potential panic; no integrity impact from a read-side flaw.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:05 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.1 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:01 cve.org
HIGH 7.1
CVE Published
Aug 10, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds.

For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided type is less than it.

For mqd_size, add new function mqd_size_from_queue_type and confirm that the provided mqd_size matches expectations.

(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)

AnalysisAI

Bounds validation is absent in the AMD KFD CRIU restore path of the Linux kernel, exposing local low-privilege users on AMD GPU systems to kernel memory disclosure and availability loss. The drm/amdkfd subsystem accepts user-controlled queue type and mqd_size values during CRIU restore without range checking, allowing crafted inputs to drive out-of-bounds kernel memory access. No public exploit has been identified, and vendor-released patches are confirmed in Linux 6.18.42 and 7.1.6.

Technical ContextAI

The affected code resides in the drm/amdkfd subsystem - the AMD GPU Kernel Fusion Driver integrated into the Linux DRM (Direct Rendering Manager) stack. CRIU (Checkpoint/Restore In Userspace) is a Linux facility for saving and restoring process state, including GPU queue state managed by KFD. During CRIU restore, private data supplied by userspace includes a queue type enum and an mqd_size (Memory Queue Descriptor size). Prior to the fix, neither value was validated against expected bounds: queue_type was not checked against a maximum enum value (KFD_QUEUE_TYPE_MAX was absent), and mqd_size was not verified against the expected size for the given queue type via a dedicated validation function. The fix introduces KFD_QUEUE_TYPE_MAX and a new mqd_size_from_queue_type function. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected kernel. Although no CWE is formally assigned, the root cause class is improper input validation (consistent with CWE-20) potentially leading to out-of-bounds read behavior (CWE-125).

RemediationAI

Upgrade the Linux kernel to version 6.18.42 or later on the 6.x stable branch, or to 7.1.6 or later on the 7.x branch; these are the confirmed vendor-released patched versions. Individual stable commits are available for manual backporting at https://git.kernel.org/stable/c/fd1691ec62701c982ea32e749678988c67fd4c21 (stable 6.x), https://git.kernel.org/stable/c/cc10a5839756982504ee8568fc1e1625962ab7f8, and https://git.kernel.org/stable/c/47ea05f246bebc81c7796f56265cffd812cf0601. On systems where AMD GPU CRIU checkpoint/restore is not in active use, restricting access to /dev/kfd via filesystem permissions (e.g., limiting the kfd device node to a dedicated group, enforced via udev rules) prevents unprivileged users from reaching the vulnerable ioctl - this is an effective and low-disruption compensating control. Blocking module loading for amdkfd (via modprobe.d blacklist) eliminates the attack surface entirely but also disables all AMD GPU functionality. Distribution vendors (RHEL, Ubuntu, SUSE) will typically carry these patches in kernel errata; check your distribution's security advisory channels for packaged updates.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55359 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy