Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-80747

drm/amdkfd: Add bounds check for CRAT subtype length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to < 1f9cc5375916b57acb1ad4443af7b4dbf347638aaffected
  • 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to < fef8c8afcb85dce5ff115f82a148cdf87a9617b9affected
  • 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to < 77b659fb104eb069ea7a61960699e4d1eea6567aaffected
  • 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to < 69164d6bdad5d6657e51436a3f602822f620a46aaffected
  • 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to < ca91e0cc8087568e4b791648a7c01e804f48cb73affected
  • 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to < 6e7566ba4739dd573c331adde1c96690f7a567bdaffected

Linux Linux

Default version status: affected

  • 3.19affected
  • 0 to < 3.19unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.1.10 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References