Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-43206

drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < 3e04bc310d80b46eaf481f1fefcbcb37a187412daffected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781faffected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < b4034442cb090e4a980bdcc1540948606cbc951baffected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940affected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < 75fb57efdd7863fffbc39db23e9cad7aafda26edaffected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < bfcd6b53e1f4feb182952f4ff9a137c36ceaf20baffected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < 4e72f419e4ed44cb3b60506752d8688c20a60a9baffected
  • 0fc8011f89feb8b2c3008583b777d097e1974660 to < 8a70a26c9f34baea6c3199a9862ddaff4554a96daffected

Linux Linux

Default version status: affected

  • 4.17affected
  • 0 to < 4.17unaffected
  • 5.10.252 to ≤ 5.10.*unaffected
  • 5.15.202 to ≤ 5.15.*unaffected
  • 6.1.165 to ≤ 6.1.*unaffected
  • 6.6.128 to ≤ 6.6.*unaffected
  • 6.12.75 to ≤ 6.12.*unaffected
  • 6.18.16 to ≤ 6.18.*unaffected
  • 6.19.6 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References