CVE-2026-46229
Memory Corruption in AMDGPU KFD VRAM Allocation
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| amd | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by clearing VRAM on allocation to prevent stale data exposure in the Linux kernel's drm/amdkfd component.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix where the KFD VRAM allocations set the AMDGPU_GEM_CREATE_VRAM_CLEARED flag properly.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's drm/amdkfd component where VRAM (Video RAM) allocations were not properly cleared before use. Specifically, while KFD VRAM allocations set the flag AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE, they did not set AMDGPU_GEM_CREATE_VRAM_CLEARED. As a result, freshly allocated VRAM could contain stale data from previous uses, which could be observed by compute kernels.
The GEM ioctl path correctly sets the VRAM_CLEARED flag for all userspace allocations, but the KFD path was missing this, allowing stale page table remnants to leak into user buffers. This flaw could cause crashes in RCCL P2P transport due to corruption in protocol handshake fields caused by non-zero stale data.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of stale data in VRAM to compute kernels, which means sensitive or residual data from previous operations might be accessible unintentionally.
Additionally, it can cause crashes in RCCL P2P transport because stale non-zero data corrupts the protocol handshake, potentially leading to instability or denial of service in systems relying on this transport.