CVE-2026-68257

Received Received - Intake

Integer Overflow in AMDKFD Linux Kernel Driver

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers(). (cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68257

EUVD

EUVD-2026-55358

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a 32-bit integer overflow occurs in calculating the total size of CWSR (Compute Work Stream Restore) memory. The calculation can wrap around due to large values, causing an undersized memory allocation that firmware later overruns.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDKFD driver and involves a 32-bit overflow in CWSR total size calculation. Detection requires checking kernel logs for related errors or examining the kernel version for the presence of the vulnerable code. No direct network detection commands are applicable.

Impact Analysis

If exploited, this could lead to memory corruption, crashes, or arbitrary code execution in the kernel. It may allow attackers to gain elevated privileges or cause denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory issue unrelated to data protection or privacy controls.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. The patch promotes total_cwsr_size to u64 and adds overflow checks in kfd_queue_acquire_buffers() and kfd_queue_release_buffers().

Hi! I’m here to help you understand CVE-2026-68257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...