EUVD-2026-59754
GHSA-hxwh-98gw-89f6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local ioctl submission requires PR:L via KFD device group; integer overflow to out-of-bounds write justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU.
Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request.
(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)
AnalysisAI
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a local user account on the target Linux system; (2) membership in the group with read-write access to /dev/kfd (typically 'render' or 'video'), which is granted by default to GPU compute users on ROCm-enabled distributions but is not present on general-purpose servers without AMD GPU compute software installed; (3) an AMD GPU from the GFX8 generation (Fiji: Radeon R9 Fury/Nano, Polaris: RX 400/500 series) or GFX9 generation (Vega: RX Vega, Radeon VII, Instinct MI series) physically installed and driven by amdkfd; (4) an affected kernel version as listed above. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes the attack as local with low-privilege entry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on an AMD ROCm-capable ML workstation or compute server - for example, a member of the 'render' group - submits a GPU queue creation ioctl with eop_ring_buffer_size set to 0xFFFFF001. The 32-bit ALIGN overflow wraps the computed size to zero, causing kfd_queue_buffer_get() to accept a 4 KB buffer object in place of the required 8 KB EOP ring on the system's Vega GFX9 GPU. … |
| Remediation | Upgrade to a patched kernel: 6.12.103 for the 6.12 stable branch, 6.18.44 for 6.18, 7.1.8 for 7.1, or 7.2-rc6 or later for the 7.2 branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running Linux with AMD KFD support and cross-reference with the CVE-2026-74447 vendor advisory to identify affected kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today