CVE-2026-45853

Analyzed Analyzed - Analysis Complete

AMDGPU Memory Corruption via Incorrect Free in Linux Kernel

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() amdgpu_discovery_get_nps_info() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption. Use kvfree() to safely handle both kmalloc and vmalloc allocations. Compile tested only. Issue found using a prototype static analysis tool and code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45853

EUVD

EUVD-2026-32319

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.11 (inc) to 6.12.75 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's amdgpu driver, specifically in the function amdgpu_gmc_get_nps_memranges(). The issue arises because the function amdgpu_discovery_get_nps_info() allocates memory using kvcalloc(), which may internally use vmalloc() for large allocations. However, the code incorrectly uses kfree() to free this memory, which is unsafe for vmalloc-allocated memory and can lead to memory corruption.

The fix involves replacing kfree() with kvfree(), which correctly handles freeing memory allocated by both kmalloc and vmalloc, preventing memory corruption.

Impact Analysis

This vulnerability can lead to memory corruption in the Linux kernel when the amdgpu driver frees memory incorrectly. Memory corruption can cause system instability, crashes, or unpredictable behavior, potentially affecting the reliability and security of systems using the affected driver.

Mitigation Strategies

The vulnerability is resolved by using kvfree() instead of kfree() in the amdgpu_gmc_get_nps_memranges() function to safely handle memory allocated by kvcalloc(), which may use vmalloc().

Immediate mitigation steps include updating the Linux kernel to a version where this fix is applied, ensuring that the amdgpu driver uses kvfree() for memory deallocation in the affected function.

Hi! I’m here to help you understand CVE-2026-45853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70