CVE-2026-74447

Received Received - Intake

Integer Overflow in AMDKFD GPU Driver Queue Buffer Handling

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU. Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request. (cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74447

EUVD

EUVD-2026-59754

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a 32-bit integer overflow in the Linux kernel's AMDKFD driver. It occurs when calculating the EOP ring buffer size alignment. A user-supplied size of 0xFFFFF001 causes the calculation to wrap to 0, bypassing a size check and allowing an oversized buffer to be accepted. This can lead to GPU faults when the EOP ring buffer is incorrectly sized.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDKFD driver and does not have network-based detection methods. Detection requires checking the kernel version and examining the AMDKFD driver code for the uint32_t overflow issue in EOP ring buffer size alignment. Review kernel logs for GPU-related faults or crashes that may indicate exploitation.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a GPU fault, potentially leading to system instability or denial of service. It may also enable unauthorized memory access if combined with other vulnerabilities, though exploitation requires specific conditions and user privileges.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level GPU driver issue in the Linux kernel that could lead to memory corruption or GPU faults, but there is no evidence it involves data exposure, unauthorized access, or privacy violations that would impact regulatory compliance.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If an update is not immediately available, consider disabling the AMDKFD driver or restricting access to GPU resources until the patch is applied. Monitor GPU-related errors in system logs as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-74447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70