In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace.
Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout.
(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Aug 17, 2026 | Aug 12, 2026 |
| Ubuntu | — | Upgrade linux-image-realtime-7.0Upgrade linux-image-aws-7.0Upgrade linux-image-realtime-64kUpgrade linux-image-gke-7.0Upgrade linux-image-realtimeUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-7.0.0-1014-awsUpgrade linux-image-azure-fdeUpgrade linux-image-oem-26.04aUpgrade linux-image-generic-64kUpgrade linux-image-7.0.0-38-realtime-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-oem-26.04Upgrade linux-image-7.0.0-1014-gcpUpgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1036-nvidia-tegra-rtUpgrade linux-image-gke-64k-7.0Upgrade linux-image-7.0.0-1016-azure-fdeUpgrade linux-image-7.0.0-38-realtimeUpgrade linux-image-7.0.0-1014-gcp-64kUpgrade linux-image-7.0.0-1015-oemUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1036-nvidia-tegraUpgrade linux-image-aws-64k-7.0Upgrade linux-image-oem-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-7.0.0-1013-oracle-64kUpgrade linux-image-nvidia-tegraUpgrade linux-image-azureUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1008-gke-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-gcpUpgrade linux-image-generic-64k-7.0Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-ibmUpgrade linux-image-aws-64kUpgrade linux-image-azure-lts-26.04Upgrade linux-image-genericUpgrade linux-image-gcp-7.0Upgrade linux-image-azure-7.0Upgrade linux-image-7.0.0-1013-oracleUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-oracle-7.0Upgrade linux-image-gkeUpgrade linux-image-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-7.0.0-38-genericUpgrade linux-image-7.0.0-38-generic-64kUpgrade linux-image-awsUpgrade linux-image-7.0.0-1017-azureUpgrade linux-image-7.0.0-1014-aws-64kUpgrade linux-image-7.0.0-1015-ibmUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-azure-fde-7.0Upgrade linux-image-virtual-7.0Upgrade linux-image-azure-fde-lts-26.04Upgrade linux-image-7.0.0-1008-gkeUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-ibm-7.0Upgrade linux-image-generic-64k-hwe-24.04 | Oct 7, 2026 | Oct 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub