CVE-2026-63881

Received Received - Intake

Integer Overflow in AMDKFD Linux Kernel Debugger

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t build. using array_size() instead, it saturates to SIZE_MAX on overflow. (cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63881

EUVD

EUVD-2026-45766

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is an integer overflow vulnerability in the Linux kernel's AMDKFD driver for the kernel debugger. The function get_queue_ids() calculates an array size by multiplying the number of queues by the size of a 32-bit integer. On 32-bit systems, this multiplication could exceed the maximum value a 32-bit integer can hold, causing an overflow. The fix uses array_size() which prevents overflow by saturating to SIZE_MAX instead.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDKFD driver and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the kernel version against patched releases. Commands like 'dmesg | grep kfd' or 'uname -a' may help identify affected systems.

Impact Analysis

If exploited, this vulnerability could lead to memory corruption or crashes in the Linux kernel, potentially causing system instability or denial of service. It may also allow local attackers to escalate privileges or execute arbitrary code with kernel-level access.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level kernel issue related to integer overflow in the AMDKFD debugger component, which could lead to memory corruption or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the AMDKFD driver if unused or applying kernel hardening measures.

Hi! I’m here to help you understand CVE-2026-63881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70