CVE-2026-98176

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1 But ffs can in theory return 1 or 0, so this could underflow (although in practice the ring buffer size cannot be less than 4096). Change this to ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4) using properties of logarithms. (cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98176

EUVD

EUVD-2026-93104

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	14328aa58ce523a59996c5a82681c43ec048cc33
Linux	Linux	14328aa58ce523a59996c5a82681c43ec048cc33
Linux	Linux	5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an integer underflow in the AMDKFD (AMD GPU kernel fusion driver) when calculating the EOP ring size. The issue occurs because the code incorrectly subtracts 1 twice from the result of ffs (find first set), which can theoretically return 0 or 1, leading to an underflow. The fix adjusts the calculation to prevent this.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/amdkfd driver and involves an integer underflow in EOP ring size calculation. Detection requires checking the kernel version and examining the affected driver code. No direct network detection commands are applicable. Use uname -a to check kernel version and grep for amdkfd in kernel logs or driver files.

Impact Analysis

This vulnerability could potentially cause system instability or crashes in systems using AMD GPUs with the affected Linux kernel component. However, the practical impact is likely minimal since the ring buffer size cannot be less than 4096, reducing the chance of exploitation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to integer underflow in the AMDKFD driver, which could theoretically impact system stability but does not involve data exposure or privacy concerns.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution. If using AMD GPU drivers, update the amdkfd module. Monitor kernel logs for related errors after updates. Avoid manual workarounds as the fix is integrated into patched kernels.

Hi! I’m here to help you understand CVE-2026-98176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70