Skip to main content

Linux Kernel EUVDEUVD-2026-59753

| CVE-2026-74446 HIGH
2026-08-15 Linux GHSA-3f2f-q78g-jqw3
Information Disclosure Linux Checkpoint Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition exploitation requires precise thread timing to win the count-to-walk IDR window, justifying AC:H over the NVD AC:L; AV:L and PR:L reflect mandatory local AMD GPU access.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 11:27 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:26 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 12:26 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: hold event_mutex while checkpointing CRIU events

kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count nor the walk holds p->event_mutex.

The CRIU checkpoint caller holds only p->mutex. Event create and destroy (kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not take p->mutex, so a second thread in the same process can insert or remove events between the count and the walk. If an event is inserted, the walk iterates more entries than were counted and writes past the end of the ev_privs allocation; if an event is removed, the walk dereferences an entry that is being freed.

Hold p->event_mutex across the count and the walk so both observe a consistent view of p->event_idr. The lock is released before copy_to_user(), which only touches the local buffer. The caller already holds p->mutex and the create/destroy paths never take p->mutex, so the p->mutex -> p->event_mutex order is not inverted and no deadlock is introduced.

(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)

AnalysisAI

Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain low-privilege local account with /dev/kfd access
Delivery
Initialize AMD KFD process owning multiple events
Exploit
Spawn concurrent thread racing event create/destroy operations
Install
Trigger CRIU checkpoint call without event_mutex held
C2
Win TOCTOU race during count-to-walk window
Execute
Trigger heap OOB write or use-after-free in kernel heap
Impact
Leverage memory corruption primitive for local privilege escalation to root
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following specific conditions: (1) an AMD GPU present on the target system with the drm/amdkfd kernel module loaded and functional; (2) a low-privilege local user account with read-write access to /dev/kfd - typically granted via membership in the 'render' group or equivalent udev-managed group, which is non-default for arbitrary local users but standard for GPU compute users; (3) the ability to initiate a CRIU checkpoint of a process that owns KFD events; (4) concurrent ability to call kfd_event_create() or kfd_event_destroy() from a second thread within the same process during the checkpoint window. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) rates this as High severity with low attack complexity, but the AC:L rating is independently disputed here: exploiting a kernel TOCTOU race requires precise thread scheduling to win the count-to-walk window, which aligns more accurately with AC:H in standard race-condition exploit practice - operators should verify this assessment against any supplemental vendor guidance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with a low-privilege account on a Linux system with an AMD GPU initializes a KFD process that owns multiple events, then spawns a second thread that rapidly and continuously creates and destroys KFD events. Simultaneously, the attacker initiates a CRIU checkpoint of the process, and by winning the race between kfd_get_num_events() and the subsequent IDR fill walk, triggers either a heap out-of-bounds write (if an event is inserted in the window) or a use-after-free (if an event is removed), providing kernel memory corruption primitives for a subsequent local privilege escalation to root. …
Remediation Upgrade to a patched Linux kernel release: 6.6.151, 6.12.103, or 6.18.44 for LTS stable series users, 7.1.8 for the 7.1 series, or 7.2-rc6 for mainline tracking. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems with AMD GPUs running Linux and assess patch deployment feasibility with infrastructure teams. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Checkpoint

View all
CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
CVE-2019-8461 HIGH POC
7.8 Aug 29

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
CVE-2019-8452 HIGH POC
7.8 Apr 22

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
CVE-2026-69112 MEDIUM POC
6.9 Aug 10

Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
CVE-2026-68447 HIGH
7.1 Aug 12

Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with

CVE-2013-7350 CRITICAL
10.0 Apr 01

Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59753 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy