CVE-2026-68257
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel, the drm/amdkfd driver has a vulnerability involving a 32-bit overflow in the CWSR total size calculation. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. The fix promotes total_cwsr_size to u64 and uses check_add_overflow()/check_mul_overflow().
Risk Assessment
The risk includes potential kernel memory corruption, which could lead to system crashes or privilege escalation. The organization may experience instability on systems with AMD GPUs.
Recommendation
It is recommended to immediately apply a Linux kernel update containing the fix (commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608). Monitor vendor distributions for available patches.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers(). (cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)