Vulnerability-Lookup

CERTFR-2026-AVI-1090

Vulnerability from certfr_avis - Published: 2026-08-28 - Updated: 2026-08-28

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian trixie versions antérieures à 6.12.105-1

References

Title

Publication Time

CVE-2026-74442 (GCVE-0-2026-74442)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-17 05:19

Title

drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while still leaving the rest of the driver in a state that calls vmw_vkms_cleanup() at module unload: 1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or returning an oversized buffer -- the common case on hosts without a VBLANK guestinfo entry -- early-returned before the workqueue allocation. 2. alloc_ordered_workqueue() returning NULL on memory pressure. vmw_vkms_cleanup() then calls destroy_workqueue(NULL), which dereferences wq->name and panics. Fix the first case by removing the early return: vmw->vkms_enabled is already false on the rpci-failure path so no work will ever be queued, and allocating the workqueue unconditionally keeps the control flow simple. Fix the second case by guarding the cleanup with a NULL check, since alloc_ordered_workqueue() can still fail under low memory.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/7c701778c6a369769…
https://git.kernel.org/stable/c/96efee36453b697cc…
https://git.kernel.org/stable/c/0ee0532f1d405d37f…
https://git.kernel.org/stable/c/05eaa887e7b4f40fb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 , < 7c701778c6a369769992614dac8dc00c8ac72afc (git) Affected: 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 , < 96efee36453b697ccbaf75091b7a1807c11809dd (git) Affected: 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 , < 0ee0532f1d405d37f38c44cbba87342e63d3bbd4 (git) Affected: 7b0062036c3b71b4a69e244ecf0502c06c4cf5f0 , < 05eaa887e7b4f40fba425f8a1d7a5a8a043092a6 (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c701778c6a369769992614dac8dc00c8ac72afc",
              "status": "affected",
              "version": "7b0062036c3b71b4a69e244ecf0502c06c4cf5f0",
              "versionType": "git"
            },
            {
              "lessThan": "96efee36453b697ccbaf75091b7a1807c11809dd",
              "status": "affected",
              "version": "7b0062036c3b71b4a69e244ecf0502c06c4cf5f0",
              "versionType": "git"
            },
            {
              "lessThan": "0ee0532f1d405d37f38c44cbba87342e63d3bbd4",
              "status": "affected",
              "version": "7b0062036c3b71b4a69e244ecf0502c06c4cf5f0",
              "versionType": "git"
            },
            {
              "lessThan": "05eaa887e7b4f40fba425f8a1d7a5a8a043092a6",
              "status": "affected",
              "version": "7b0062036c3b71b4a69e244ecf0502c06c4cf5f0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure\n\nTwo paths through vmw_vkms_init() can leave vmw-\u003ecrc_workq NULL while\nstill leaving the rest of the driver in a state that calls\nvmw_vkms_cleanup() at module unload:\n\n  1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or\n     returning an oversized buffer -- the common case on hosts\n     without a VBLANK guestinfo entry -- early-returned before the\n     workqueue allocation.\n  2. alloc_ordered_workqueue() returning NULL on memory pressure.\n\nvmw_vkms_cleanup() then calls destroy_workqueue(NULL), which\ndereferences wq-\u003ename and panics.\n\nFix the first case by removing the early return: vmw-\u003evkms_enabled\nis already false on the rpci-failure path so no work will ever be\nqueued, and allocating the workqueue unconditionally keeps the\ncontrol flow simple.  Fix the second case by guarding the cleanup\nwith a NULL check, since alloc_ordered_workqueue() can still fail\nunder low memory."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:19:29.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c701778c6a369769992614dac8dc00c8ac72afc"
        },
        {
          "url": "https://git.kernel.org/stable/c/96efee36453b697ccbaf75091b7a1807c11809dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ee0532f1d405d37f38c44cbba87342e63d3bbd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/05eaa887e7b4f40fba425f8a1d7a5a8a043092a6"
        }
      ],
      "title": "drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74442",
    "datePublished": "2026-08-15T12:26:50.102Z",
    "dateReserved": "2026-08-15T05:44:03.897Z",
    "dateUpdated": "2026-08-17T05:19:29.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74443 (GCVE-0-2026-74443)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36

Title

drm/vmwgfx: bound DMA command body size against suffix pointer

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/eb20f418933bea533…
https://git.kernel.org/stable/c/fcd1e56e7816b31a1…
https://git.kernel.org/stable/c/a4a37080a5ac777b5…
https://git.kernel.org/stable/c/036e16ada95389bdc…
https://git.kernel.org/stable/c/d5d7ada4e1296b00d…
https://git.kernel.org/stable/c/7e40e6120fb232a10…
https://git.kernel.org/stable/c/9759da60e38d7b9db…
https://git.kernel.org/stable/c/f4f1db96bfd68b810…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < eb20f418933bea53375843b27b4022c1810be63b (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < fcd1e56e7816b31a1050ccc67df722b20f6bb15d (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < a4a37080a5ac777b59306cfcdf854cc05d7604d4 (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < 036e16ada95389bdc30f41068af04c1d0872fad0 (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7 (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6 (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < 9759da60e38d7b9db44dc92713e4e0391883d221 (git) Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < f4f1db96bfd68b81053693ba53405b6f510ac16c (git)
Linux	Linux	Affected: 2.6.33 Unaffected: 0 , < 2.6.33 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb20f418933bea53375843b27b4022c1810be63b",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "fcd1e56e7816b31a1050ccc67df722b20f6bb15d",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "a4a37080a5ac777b59306cfcdf854cc05d7604d4",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "036e16ada95389bdc30f41068af04c1d0872fad0",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "9759da60e38d7b9db44dc92713e4e0391883d221",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "f4f1db96bfd68b81053693ba53405b6f510ac16c",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) \u0026cmd-\u003ebody + header-\u003esize - sizeof(*suffix)\n\nwithout checking that header-\u003esize is large enough to contain both\ncmd-\u003ebody and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix-\u003emaximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother\u0027s GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing DRM_IOCTL_VMW_EXECBUF with a crafted SVGA command batch via /dev/dri/card* or /dev/dri/renderD*, the standard local DRM render-node path for the vmwgfx driver in VMware virtual machines.\nAC:L - The attacker fully controls execbuf command layout and can set an undersized SVGA_3D_CMD_SURFACE_DMA header-\u003esize so the suffix pointer underflows into the prior command; no races, rare configs, or victim-dependent heap layout are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local user with access to the DRM render node (typically membership in the render/video group on VMware guests) can reach vmw_cmd_dma without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the DRM device and submitting a malicious execbuf ioctl; exploitation does not depend on another user mounting filesystems or performing other actions.\nS:C - The bug is a TOCTOU on the device-visible SVGA command stream: verifier writes clobber already-checked fields (GMR id, surface id, DMA bounds) in the bounce buffer before submission to the VMware virtual GPU, bypassing guest/host isolation enforced by command authentication.\nC:H - Rewriting authenticated GMR/surface identifiers or inflating maximumOffset can authorize SVGA surface DMA reads (including SVGA3D_READ_HOST_VRAM) beyond validated guest buffer bounds, yielding arbitrary guest memory disclosure and plausible host VRAM reads via the virtual device backend.\nI:H - Clobbering verified command fields lets a later command rewrite another\u0027s GMR id, surface id, or DMA limit so the hypervisor executes unauthorized SVGA3D_WRITE_HOST_VRAM or guest GMR DMA, enabling arbitrary memory write and code-execution primitives typical of kernel heap corruption.\nA:H - Corrupting the bounce-buffer command stream before FIFO submission can panic the guest kernel (invalid SVGA commands/resources) and enables repeatable denial of service; memory corruption in the verifier path is independently rated High per kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:35.874Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c"
        }
      ],
      "title": "drm/vmwgfx: bound DMA command body size against suffix pointer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74443",
    "datePublished": "2026-08-15T12:26:50.826Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-19T16:36:35.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74444 (GCVE-0-2026-74444)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36

Title

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/b89ca4bba820f79dd…
https://git.kernel.org/stable/c/bef30317fcb4c838a…
https://git.kernel.org/stable/c/112c6ff29a56f3a22…
https://git.kernel.org/stable/c/2666cddf0dd218aa9…
https://git.kernel.org/stable/c/fc0c02f510e41650d…
https://git.kernel.org/stable/c/dc0be7662b7b0ce28…
https://git.kernel.org/stable/c/c77cf8edae2bd3a15…
https://git.kernel.org/stable/c/85891d174707d8bdd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < b89ca4bba820f79dde52af15ee139fe6e8bbc314 (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < bef30317fcb4c838a37bceb2fc76256eb6b975c1 (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < 112c6ff29a56f3a22db4d5af869697aa07035ad6 (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < 2666cddf0dd218aa9bd1f99db688d1b532eac21a (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < fc0c02f510e41650df3479f96e257acf87d8a20a (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < dc0be7662b7b0ce28cb5eea864737793ed7b9e70 (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < c77cf8edae2bd3a1599115301cc7c98d0c78e731 (git) Affected: 7a73ba7469cbea631050094fd14f73acebb97cf9 , < 85891d174707d8bddcec7a888fb4e1d17def34f3 (git)
Linux	Linux	Affected: 2.6.33 Unaffected: 0 , < 2.6.33 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b89ca4bba820f79dde52af15ee139fe6e8bbc314",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "bef30317fcb4c838a37bceb2fc76256eb6b975c1",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "112c6ff29a56f3a22db4d5af869697aa07035ad6",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "2666cddf0dd218aa9bd1f99db688d1b532eac21a",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "fc0c02f510e41650df3479f96e257acf87d8a20a",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "dc0be7662b7b0ce28cb5eea864737793ed7b9e70",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "c77cf8edae2bd3a1599115301cc7c98d0c78e731",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "85891d174707d8bddcec7a888fb4e1d17def34f3",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header-\u003esize - sizeof(cmd-\u003ebody)) / sizeof(*decl);\n\nwhere header-\u003esize is u32 and is taken straight from the user-supplied\ncommand stream.  When header-\u003esize is less than sizeof(cmd-\u003ebody) the\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.\nAny user-controlled cmd-\u003ebody.numVertexDecls then passes the bound and\nthe loop dereferences decl[i] far past the end of the kernel command\nbounce buffer, producing an out-of-bounds read of kernel memory.\n\nReject undersized headers up front."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local DRM_IOCTL_VMW_EXECBUF ioctl (vmw_execbuf_ioctl -\u003e vmw_execbuf_process -\u003e vmw_cmd_check_all -\u003e vmw_cmd_draw); it is not reachable from network, adjacent wireless, or physical buses.\nAC:L - An attacker fully controls the user command stream and can set header-\u003esize below sizeof(cmd-\u003ebody) to underflow maxnum and bypass numVertexDecls bounds; no races or victim-dependent timing are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local process with access to the vmwgfx render node (/dev/dri/renderD*) and a user-created 3D context can submit the malicious DRAW_PRIMITIVES command without real root.\nUI:N - Exploitation requires only the attacker opening the render device and issuing crafted execbuf ioctls; no additional actions by another user or administrator are needed.\nS:U - Impact is confined to the guest kernel address space running vmwgfx (VMware SVGA virtual GPU); successful exploitation yields guest-kernel memory disclosure/corruption and privilege escalation, not a direct hypervisor/host escape.\nC:H - Unsigned underflow makes maxnum enormous, so the vertex-declaration loop dereferences decl[i] far beyond the vmalloc command bounce buffer and reads adjacent kernel heap memory (e.g., decl-\u003earray.surfaceId) into validation paths.\nI:H - Beyond disclosure, leaked/adjacent surfaceId values can satisfy vmw_user_resource_lookup_handle and vmw_resource_relocations_apply then writes resource IDs to offsets past the bounce buffer, giving an out-of-bounds kernel write primitive.\nA:H - Setting a large numVertexDecls after the bound bypass can walk far past the vmalloc allocation and fault on unmapped pages, and extensive heap corruption from relocation writes can also trigger kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:38.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314"
        },
        {
          "url": "https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70"
        },
        {
          "url": "https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731"
        },
        {
          "url": "https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3"
        }
      ],
      "title": "drm/vmwgfx: validate DRAW_PRIMITIVES header size before division",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74444",
    "datePublished": "2026-08-15T12:26:51.443Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-19T16:36:38.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74445 (GCVE-0-2026-74445)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-17 05:19

Title

drm/vmwgfx: reject DX_BIND_QUERY without a DX context

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with dx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY opcode in the command stream: dx_ctx_node is left NULL and the kernel oopses on the assignment. The same NULL is then re-read in vmw_resources_reserve() via vmw_context_get_dx_query_mob(). All sibling DX handlers fail-close on a missing dx_ctx_node using VMW_GET_CTX_NODE(). Use the same pattern here, returning -EINVAL up front before any relocation state is published.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/7eae011829f94a764…
https://git.kernel.org/stable/c/0634d50e8b398c25b…
https://git.kernel.org/stable/c/e479240a1e076ba11…
https://git.kernel.org/stable/c/6b1eb0b63cc153e1c…
https://git.kernel.org/stable/c/55ec09c9ce10b1272…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9c079b8ce8bf8e0394149eb39c78b04285644bcc , < 7eae011829f94a76470ec76f016805f508437755 (git) Affected: 9c079b8ce8bf8e0394149eb39c78b04285644bcc , < 0634d50e8b398c25bd07c96b048e484d22688c26 (git) Affected: 9c079b8ce8bf8e0394149eb39c78b04285644bcc , < e479240a1e076ba1104236331abd62400bf1d495 (git) Affected: 9c079b8ce8bf8e0394149eb39c78b04285644bcc , < 6b1eb0b63cc153e1c0cb5ab8350950119be11947 (git) Affected: 9c079b8ce8bf8e0394149eb39c78b04285644bcc , < 55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7eae011829f94a76470ec76f016805f508437755",
              "status": "affected",
              "version": "9c079b8ce8bf8e0394149eb39c78b04285644bcc",
              "versionType": "git"
            },
            {
              "lessThan": "0634d50e8b398c25bd07c96b048e484d22688c26",
              "status": "affected",
              "version": "9c079b8ce8bf8e0394149eb39c78b04285644bcc",
              "versionType": "git"
            },
            {
              "lessThan": "e479240a1e076ba1104236331abd62400bf1d495",
              "status": "affected",
              "version": "9c079b8ce8bf8e0394149eb39c78b04285644bcc",
              "versionType": "git"
            },
            {
              "lessThan": "6b1eb0b63cc153e1c0cb5ab8350950119be11947",
              "status": "affected",
              "version": "9c079b8ce8bf8e0394149eb39c78b04285644bcc",
              "versionType": "git"
            },
            {
              "lessThan": "55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db",
              "status": "affected",
              "version": "9c079b8ce8bf8e0394149eb39c78b04285644bcc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: reject DX_BIND_QUERY without a DX context\n\nvmw_cmd_dx_bind_query() unconditionally dereferences\nsw_context-\u003edx_ctx_node-\u003ectx.  Userspace can trigger a NULL pointer\ndereference from any render-node fd by submitting an execbuf with\ndx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY\nopcode in the command stream: dx_ctx_node is left NULL and the kernel\noopses on the assignment.  The same NULL is then re-read in\nvmw_resources_reserve() via vmw_context_get_dx_query_mob().\n\nAll sibling DX handlers fail-close on a missing dx_ctx_node using\nVMW_GET_CTX_NODE().  Use the same pattern here, returning -EINVAL up\nfront before any relocation state is published."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:19:32.678Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755"
        },
        {
          "url": "https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26"
        },
        {
          "url": "https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947"
        },
        {
          "url": "https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db"
        }
      ],
      "title": "drm/vmwgfx: reject DX_BIND_QUERY without a DX context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74445",
    "datePublished": "2026-08-15T12:26:52.063Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-17T05:19:32.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74446 (GCVE-0-2026-74446)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36

Title

drm/amdkfd: hold event_mutex while checkpointing CRIU events

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count nor the walk holds p->event_mutex. The CRIU checkpoint caller holds only p->mutex. Event create and destroy (kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not take p->mutex, so a second thread in the same process can insert or remove events between the count and the walk. If an event is inserted, the walk iterates more entries than were counted and writes past the end of the ev_privs allocation; if an event is removed, the walk dereferences an entry that is being freed. Hold p->event_mutex across the count and the walk so both observe a consistent view of p->event_idr. The lock is released before copy_to_user(), which only touches the local buffer. The caller already holds p->mutex and the create/destroy paths never take p->mutex, so the p->mutex -> p->event_mutex order is not inverted and no deadlock is introduced. (cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/8f7196f25b14f4290…
https://git.kernel.org/stable/c/2040b7e39027cb83b…
https://git.kernel.org/stable/c/9a7f765985f64fd4a…
https://git.kernel.org/stable/c/6a52f48157fa7fb81…
https://git.kernel.org/stable/c/bed80be08c0bee47f…
https://git.kernel.org/stable/c/ff8bc5a68a9a70bdc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 40e8a766a761f7fdc8530347527b344fddf6f1a8 , < 8f7196f25b14f4290738639a50459b56a5ff2784 (git) Affected: 40e8a766a761f7fdc8530347527b344fddf6f1a8 , < 2040b7e39027cb83bb8c7b84a4c95c2f6053c32f (git) Affected: 40e8a766a761f7fdc8530347527b344fddf6f1a8 , < 9a7f765985f64fd4a7a58f7bc9cd80a1f4230628 (git) Affected: 40e8a766a761f7fdc8530347527b344fddf6f1a8 , < 6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd (git) Affected: 40e8a766a761f7fdc8530347527b344fddf6f1a8 , < bed80be08c0bee47fa242a4256ac873477c815f8 (git) Affected: 40e8a766a761f7fdc8530347527b344fddf6f1a8 , < ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 (git)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f7196f25b14f4290738639a50459b56a5ff2784",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "2040b7e39027cb83bb8c7b84a4c95c2f6053c32f",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "9a7f765985f64fd4a7a58f7bc9cd80a1f4230628",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "bed80be08c0bee47fa242a4256ac873477c815f8",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: hold event_mutex while checkpointing CRIU events\n\nkfd_criu_checkpoint_events() counts the entries in p-\u003eevent_idr via\nkfd_get_num_events(), allocates an array sized to that count, and then\nwalks the same IDR to fill it. Neither the count nor the walk holds\np-\u003eevent_mutex.\n\nThe CRIU checkpoint caller holds only p-\u003emutex. Event create and destroy\n(kfd_event_create()/kfd_event_destroy()) take p-\u003eevent_mutex and do not\ntake p-\u003emutex, so a second thread in the same process can insert or remove\nevents between the count and the walk. If an event is inserted, the walk\niterates more entries than were counted and writes past the end of the\nev_privs allocation; if an event is removed, the walk dereferences an\nentry that is being freed.\n\nHold p-\u003eevent_mutex across the count and the walk so both observe a\nconsistent view of p-\u003eevent_idr. The lock is released before\ncopy_to_user(), which only touches the local buffer. The caller already\nholds p-\u003emutex and the create/destroy paths never take p-\u003emutex, so the\np-\u003emutex -\u003e p-\u003eevent_mutex order is not inverted and no deadlock is\nintroduced.\n\n(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through AMDKFD_IOC_CRIU_OP_CHECKPOINT on /dev/kfd, a local character-device ioctl in the amdgpu/amdkfd GPU compute stack, not via any network-facing kernel service.\nAC:L - Exploitation needs a race between CRIU checkpoint and concurrent event create/destroy in the same KFD process; the attacker controls both threads and can repeat the ioctl and event churn until the TOCTOU window is hit reliably.\nPR:L - CRIU checkpoint requires CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN, both obtainable by an unprivileged user via a user namespace (same model as other namespace-granted caps); GPU tenant access to /dev/kfd on ROCm/HPC nodes is sufficient.\nUI:N - No victim interaction is required beyond the attacker opening /dev/kfd and driving CRIU checkpoint and event ioctls from their own process threads.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security domain; it does not cross a guest/host or IOMMU/DMA trust boundary on its own.\nC:H - Concurrent event removal causes the checkpoint walk to dereference kfd_event objects being freed (UAF), and OOB writes of 64-byte kfd_criu_event_priv_data entries can corrupt adjacent kernel memory to leak data.\nI:H - If events are inserted between kfd_get_num_events() and the IDR walk, the checkpoint loop writes past the end of the kvzalloc ev_privs buffer, enabling heap overflow and control of freed-object contents for arbitrary write primitives.\nA:H - The UAF and heap out-of-bounds write can trigger kernel oops/panic during checkpoint or corrupt critical kernel structures, causing denial of service or system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:41.097Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f7196f25b14f4290738639a50459b56a5ff2784"
        },
        {
          "url": "https://git.kernel.org/stable/c/2040b7e39027cb83bb8c7b84a4c95c2f6053c32f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a7f765985f64fd4a7a58f7bc9cd80a1f4230628"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed80be08c0bee47fa242a4256ac873477c815f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2"
        }
      ],
      "title": "drm/amdkfd: hold event_mutex while checkpointing CRIU events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74446",
    "datePublished": "2026-08-15T12:26:52.677Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-19T16:36:41.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74447 (GCVE-0-2026-74447)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-17 05:47

Title

drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU. Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request. (cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/273548eb997c6be85…
https://git.kernel.org/stable/c/6dc0b4b39ed4f11ef…
https://git.kernel.org/stable/c/7c54bd225d83bc1bc…
https://git.kernel.org/stable/c/83463a96ea3c7d8ae…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ee0dc6c66a913260311876a4b2b53fe0b9bc3f94 , < 273548eb997c6be85230c1236b18784b09f6203c (git) Affected: acfc84cfa70aca5b970faf152979bc97b9f8b0c0 , < 6dc0b4b39ed4f11ef70f76ecea8537e35f45342b (git) Affected: 42ea9cf2f16b7131cb7302acb3dac510968f8bdc , < 7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961 (git) Affected: 42ea9cf2f16b7131cb7302acb3dac510968f8bdc , < 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 (git) Affected: c6ce687077cc67e4f3cbd0c89cb356fbbce91f4c (git) Affected: 6.12.75 , < 6.12.103 (semver) Affected: 6.18.16 , < 6.18.44 (semver) Affected: 6.19.6 , < 6.20 (semver)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "273548eb997c6be85230c1236b18784b09f6203c",
              "status": "affected",
              "version": "ee0dc6c66a913260311876a4b2b53fe0b9bc3f94",
              "versionType": "git"
            },
            {
              "lessThan": "6dc0b4b39ed4f11ef70f76ecea8537e35f45342b",
              "status": "affected",
              "version": "acfc84cfa70aca5b970faf152979bc97b9f8b0c0",
              "versionType": "git"
            },
            {
              "lessThan": "7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961",
              "status": "affected",
              "version": "42ea9cf2f16b7131cb7302acb3dac510968f8bdc",
              "versionType": "git"
            },
            {
              "lessThan": "83463a96ea3c7d8ae636a4d6a0ba63c9ce410724",
              "status": "affected",
              "version": "42ea9cf2f16b7131cb7302acb3dac510968f8bdc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6ce687077cc67e4f3cbd0c89cb356fbbce91f4c",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.44",
              "status": "affected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.18.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment\n\neop_ring_buffer_size in struct queue_properties is a u32. In\nkfd_queue_acquire_buffers() the expected EOP buffer size is computed as\nALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the\naddition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to\n0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on\nsize != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD\ncp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB\nBO, so CP EOP writes can land past the buffer and fault the GPU.\n\nCast the operand to u64 so the alignment is computed in 64-bit; the size\ncheck in kfd_queue_buffer_get() then rejects the oversized request.\n\n(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl access to /dev/kfd (KFD_IOC_CREATE_QUEUE) after opening the AMDGPU render node; there is no network, adjacent-wireless, or physical-device path to the vulnerable kfd_queue_acquire_buffers() code.\nAC:L - An attacker who can open /dev/kfd and map GPU buffers can reliably bypass the EOP size check with eop_buffer_size=0xFFFFF001 (32-bit ALIGN wraps to 0) and trigger CP EOP writes by submitting compute work on the created queue.\nPR:L - Only a local unprivileged user with AMDGPU/KFD access (typically membership in the render group for /dev/dri/renderD* and /dev/kfd) is required; no real-root or init-namespace capabilities are needed.\nUI:N - No victim interaction is required; the attacker drives the full chain via their own KFD and DRM file descriptors, GPU memory mappings, and queue submission.\nS:U - The bug corrupts GPU virtual memory within the attacker\u0027s own process VMID and can fault or reset the shared GPU; it does not cross a VM/host, IOMMU, or sandbox security boundary into another authority.\nC:H - CP hardware performs out-of-bounds EOP writes up to 8KB into a 4KB backing object, corrupting adjacent GPU-mapped memory that can be read back or chained into further memory disclosure primitives.\nI:H - The MQD is programmed with an 8KB EOP ring while only a 4KB buffer is validated, causing the GPU command processor to write attacker-triggered data past the buffer end into adjacent GPU mappings.\nA:H - EOP writes beyond the undersized buffer cause GPU VM faults that can hang the device and schedule amdgpu_amdkfd_gpu_reset(), denying GPU service to all co-located workloads on shared cloud/HPC/desktop GPUs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:18.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/273548eb997c6be85230c1236b18784b09f6203c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dc0b4b39ed4f11ef70f76ecea8537e35f45342b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961"
        },
        {
          "url": "https://git.kernel.org/stable/c/83463a96ea3c7d8ae636a4d6a0ba63c9ce410724"
        }
      ],
      "title": "drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74447",
    "datePublished": "2026-08-15T12:26:53.305Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-17T05:47:18.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74448 (GCVE-0-2026-74448)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-18 06:56

Title

drm/amdkfd: fix QID bit leak in pqm_create_queue()

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqm_create_queue() When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() returns early via 'return retval' without going through the err_create_queue cleanup label. This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called, leaving the reserved QID bit permanently set in queue_slot_bitmap. Over time this leaks QID slots, potentially exhausting all available queue slots. Fix this by replacing 'return retval' with 'goto err_allocate_pqn' so that clear_bit() is always called on the error path without touching the uninitialized pqn pointer. AILIKFD-813 (cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)

Severity

No CVSS data available.

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/8924e2594a15bdbd0…
https://git.kernel.org/stable/c/2ff5bb3645c72b369…
https://git.kernel.org/stable/c/5f0f2ddeac738e2ca…
https://git.kernel.org/stable/c/7c35bf94150d872e6…
https://git.kernel.org/stable/c/38b73293f38658a46…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0f88894aa628680747ae27760e5f627f901a435f , < 8924e2594a15bdbd07f8696770864366d787ab70 (git) Affected: c0ef1c8ef70bfa3487ea84f794d7a1f0fea0735d , < 2ff5bb3645c72b3690e70c513a62a86600c4632f (git) Affected: fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 , < 5f0f2ddeac738e2ca9d12cb76a1ff2904e85ecc3 (git) Affected: fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 , < 7c35bf94150d872e670a6632aa819d320279effb (git) Affected: fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 , < 38b73293f38658a4685ffcea666462024f858ad9 (git) Affected: 9d61e2b81f5fc90c87975879809346e7c90ea5f9 (git) Affected: d86ba913bbfd1afafacbfb750001ffc6bfe29da0 (git) Affected: 6.6.87 , < 6.6.151 (semver) Affected: 6.12.23 , < 6.12.103 (semver) Affected: 6.13.11 , < 6.14 (semver) Affected: 6.14.2 , < 6.15 (semver)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8924e2594a15bdbd07f8696770864366d787ab70",
              "status": "affected",
              "version": "0f88894aa628680747ae27760e5f627f901a435f",
              "versionType": "git"
            },
            {
              "lessThan": "2ff5bb3645c72b3690e70c513a62a86600c4632f",
              "status": "affected",
              "version": "c0ef1c8ef70bfa3487ea84f794d7a1f0fea0735d",
              "versionType": "git"
            },
            {
              "lessThan": "5f0f2ddeac738e2ca9d12cb76a1ff2904e85ecc3",
              "status": "affected",
              "version": "fddc45026311c05a5355fd34b9dc0a1d7eaef4a2",
              "versionType": "git"
            },
            {
              "lessThan": "7c35bf94150d872e670a6632aa819d320279effb",
              "status": "affected",
              "version": "fddc45026311c05a5355fd34b9dc0a1d7eaef4a2",
              "versionType": "git"
            },
            {
              "lessThan": "38b73293f38658a4685ffcea666462024f858ad9",
              "status": "affected",
              "version": "fddc45026311c05a5355fd34b9dc0a1d7eaef4a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9d61e2b81f5fc90c87975879809346e7c90ea5f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d86ba913bbfd1afafacbfb750001ffc6bfe29da0",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.87",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix QID bit leak in pqm_create_queue()\n\nWhen MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during\nthe first queue creation for a process, pqm_create_queue() returns\nearly via \u0027return retval\u0027 without going through the err_create_queue\ncleanup label.\n\nThis means clear_bit(*qid, pqm-\u003equeue_slot_bitmap) is never called,\nleaving the reserved QID bit permanently set in queue_slot_bitmap.\nOver time this leaks QID slots, potentially exhausting all available\nqueue slots.\n\nFix this by replacing \u0027return retval\u0027 with \u0027goto err_allocate_pqn\u0027\nso that clear_bit() is always called on the error path without\ntouching the uninitialized pqn pointer.\n\nAILIKFD-813\n\n(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:34.583Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8924e2594a15bdbd07f8696770864366d787ab70"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ff5bb3645c72b3690e70c513a62a86600c4632f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f0f2ddeac738e2ca9d12cb76a1ff2904e85ecc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c35bf94150d872e670a6632aa819d320279effb"
        },
        {
          "url": "https://git.kernel.org/stable/c/38b73293f38658a4685ffcea666462024f858ad9"
        }
      ],
      "title": "drm/amdkfd: fix QID bit leak in pqm_create_queue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74448",
    "datePublished": "2026-08-15T12:26:53.915Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-18T06:56:34.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74450 (GCVE-0-2026-74450)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-23 12:47

Title

drm/amd/pm: fix pptable use-after-free

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_table write can replace and free the allocation during the copy, causing a use-after-free. Change the DPM interface to copy into caller-provided storage while the mutex is held. Keep the size-only query for attribute discovery without exposing the driver-owned pointer. (cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/3fbb3ac75000e3187…
https://git.kernel.org/stable/c/9efc767335234cf7a…
https://git.kernel.org/stable/c/81b5af1fb0f14cace…
https://git.kernel.org/stable/c/8c685df5c3b261c42…
https://git.kernel.org/stable/c/b628f2c6feb3a115e…
https://git.kernel.org/stable/c/bb493058c35c8676e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 3fbb3ac75000e3187f500a91a4099b24206866a1 (git) Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 9efc767335234cf7a892e46d45cd453b711421e7 (git) Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 81b5af1fb0f14cace6c3b3130a05e5602a597820 (git) Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < 8c685df5c3b261c42505110965b42f9a754eb9b7 (git) Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < b628f2c6feb3a115ea72d3120a2bd94afc5163df (git) Affected: 1684d3ba488529266ce6f97b88076bd185f4790e , < bb493058c35c8676e48269ab6732688ea733d23c (git)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/amdgpu_dpm.c",
            "drivers/gpu/drm/amd/pm/amdgpu_pm.c",
            "drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3fbb3ac75000e3187f500a91a4099b24206866a1",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "9efc767335234cf7a892e46d45cd453b711421e7",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "81b5af1fb0f14cace6c3b3130a05e5602a597820",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "8c685df5c3b261c42505110965b42f9a754eb9b7",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "b628f2c6feb3a115ea72d3120a2bd94afc5163df",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            },
            {
              "lessThan": "bb493058c35c8676e48269ab6732688ea733d23c",
              "status": "affected",
              "version": "1684d3ba488529266ce6f97b88076bd185f4790e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/amdgpu_dpm.c",
            "drivers/gpu/drm/amd/pm/amdgpu_pm.c",
            "drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix pptable use-after-free\n\namdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table\nafter dropping adev-\u003epm.mutex. The sysfs path then copies from that pointer.\nA concurrent pp_table write can replace and free the allocation during the\ncopy, causing a use-after-free.\n\nChange the DPM interface to copy into caller-provided storage while the mutex\nis held. Keep the size-only query for attribute discovery without exposing\nthe driver-owned pointer.\n\n(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local sysfs read/write on /sys/class/drm/cardN/device/pp_table (amdgpu_get_pp_table/amdgpu_set_pp_table); no network, adjacent, or physical-access path exists into amdgpu_dpm_get_pp_table().\nAC:L - A single attacker can drive both sides of the race with concurrent pp_table read and write threads; the write path holds pm.mutex during smu_reset/smu_sys_set_pp_table() while the read copies up to PAGE_SIZE-1 bytes from a pointer obtained after mutex drop.\nPR:L - Triggering the concurrent write/free requires sysfs write access to pp_table; the kernel CNA\u0027s CVE-2025-21780 scored the same attribute PR:L because gaming/handheld udev rules commonly group-write pp_* nodes and the commit describes a concurrent pp_table write.\nUI:N - Exploitation is performed by the attacker\u0027s own concurrent sysfs read/write loops; no action by another user or victim is required.\nS:U - The use-after-free corrupts kernel heap memory during a sysfs memcpy in amdgpu_pm.c; impact stays within the kernel security authority with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free on a kmalloc\u0027d pp table during memcpy can return freed/reallocated kernel heap contents up to PAGE_SIZE-1 bytes to userspace and enables arbitrary kernel memory reads via heap grooming.\nI:H - Concurrent pp_table writes control kmalloc size/contents while reads dereference the freed pptable, classic UAF heap corruption that can be weaponized for arbitrary kernel writes and privilege escalation.\nA:H - Reading freed pptable memory during memcpy causes kernel oops/panic and smu_reset() during the concurrent write can wedge discrete AMD GPUs; UAF reliably threatens system/GPU availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:19.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c"
        }
      ],
      "title": "drm/amd/pm: fix pptable use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74450",
    "datePublished": "2026-08-15T12:26:55.127Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-23T12:47:19.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74451 (GCVE-0-2026-74451)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-17 05:47

Title

drm/panthor: validate firmware interface structure sizes

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interface structure, so accepting an address near the end of the shared section can still lead to out-of-bounds accesses. Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges that do not fit entirely in the shared section.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/21c77486f5a60bb9c…
https://git.kernel.org/stable/c/c835f2b0b71675848…
https://git.kernel.org/stable/c/ca41d9f3a21586bf2…
https://git.kernel.org/stable/c/b921b8613790a3f9e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 21c77486f5a60bb9c0433c21de62a5f25d5091f1 (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < c835f2b0b7167584832b516c9b0a26e9180d1d0b (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < ca41d9f3a21586bf29df53eec05152ecf2b2f94f (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < b921b8613790a3f9e78ab64017fa7149ef0b750c (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21c77486f5a60bb9c0433c21de62a5f25d5091f1",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "c835f2b0b7167584832b516c9b0a26e9180d1d0b",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "ca41d9f3a21586bf29df53eec05152ecf2b2f94f",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "b921b8613790a3f9e78ab64017fa7149ef0b750c",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Out-of-bounds kernel accesses occur when panthor_fw_init_ifaces() accepts firmware MCU input_va/output_va at probe, then runtime DRM paths (GROUP_SUBMIT, scheduling, job IRQ handlers) dereference those cached interface pointers via /dev/dri/renderD* ioctls; no network or physical access is involved.\nAC:L - Once malicious or mis-layouted firmware publishes interface VAs near the shared-section end, iface_fw_to_cpu_addr() deterministically returns out-of-bounds pointers and every GPU submission or firmware event reliably performs the same OOB reads/writes without races or uncontrollable heap layout.\nPR:L - Planting a crafted mali_csffw.bin that makes the MCU publish bad interface VAs is feasible for local vendor/system accounts on Mali Android, Chromebook, and embedded firmware partitions; triggering the corruption afterward requires only standard render-node access (DRM_RENDER_ALLOW), not real init-namespace root.\nUI:N - After the bad interface pointers are established at driver probe or firmware boot, exploitation is driven entirely by the attacker\u0027s own GPU ioctl submissions and does not require any separate victim to open files, mount filesystems, or perform other interactive actions.\nS:U - The bug corrupts kernel heap memory adjacent to the firmware shared-section BO and can enable local privilege escalation within the host kernel, but it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.\nC:H - Kernel code routinely READ_ONCEs large panthor_fw_*_output_iface structures (fault_info, status_wait_sync_ptr, heap metadata, etc.) through pointers that can extend hundreds of bytes past the shared BO, yielding out-of-bounds kernel memory disclosure rather than a bounded leak.\nI:H - Kernel code writes full panthor_fw_*_input_iface structures (ringbuf_base, heap_start/end, req/ack fields via panthor_fw_update_reqs) through the same undersized mappings, enabling out-of-bounds kernel writes exploitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds reads and writes against the vmap of the firmware shared-section BO can immediately trigger kernel oopses or panics and remain reachable on every subsequent GPU job submission or firmware interrupt until the driver is reloaded."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:22.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c"
        }
      ],
      "title": "drm/panthor: validate firmware interface structure sizes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74451",
    "datePublished": "2026-08-15T12:26:55.722Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-17T05:47:22.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-74452 (GCVE-0-2026-74452)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-17 05:47

Title

drm/panthor: reject firmware sections with oversized data

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.size = hdr.data.end - hdr.data.start; If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem() memcpy(section->mem->kmap, section->data.buf, section->data.size); Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory? memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size); Reject section entries whose initial data is larger than the section size.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/0e57165ca025a67d8…
https://git.kernel.org/stable/c/2a761b9be5863e1d2…
https://git.kernel.org/stable/c/7f4674d986c15c743…
https://git.kernel.org/stable/c/a3caaa06809248b99…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 0e57165ca025a67d8dfd17efd2765fdd4925fdab (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 2a761b9be5863e1d26a584f0c2d1e114a684ed9a (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 7f4674d986c15c74327cb6ac6e2e2afecf061e04 (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < a3caaa06809248b996254be5b47e10804a3494e2 (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e57165ca025a67d8dfd17efd2765fdd4925fdab",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "2a761b9be5863e1d26a584f0c2d1e114a684ed9a",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "7f4674d986c15c74327cb6ac6e2e2afecf061e04",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "a3caaa06809248b996254be5b47e10804a3494e2",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: reject firmware sections with oversized data\n\nIn panthor_fw_load_section_entry(), the data size to copy is calculated\nwithout validating it against the allocated section_size:\n\n    section-\u003edata.size = hdr.data.end - hdr.data.start;\n\nIf a crafted firmware sets data.size larger than the allocated memory,\nthis could cause a heap buffer overflow in panthor_fw_init_section_mem()\n\n    memcpy(section-\u003emem-\u003ekmap, section-\u003edata.buf, section-\u003edata.size);\n\nAdditionally, if the section-\u003edata.size exceeds the BO size, could this\nmemset underflow the size calculation, leading to a massive out-of-bounds\nzeroing of kernel memory?\n\n    memset(section-\u003emem-\u003ekmap + section-\u003edata.size, 0,\n           panthor_kernel_bo_size(section-\u003emem) - section-\u003edata.size);\n\nReject section entries whose initial data is larger than the section size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only when panthor_fw_load() parses mali_csffw.bin from the local firmware search path during platform probe (panthor_probe\u2192panthor_fw_init\u2192panthor_fw_load_section_entry\u2192panthor_fw_init_section_mem); no network, DRM ioctl, or /dev/dri/renderD* path feeds attacker-controlled firmware headers.\nAC:L - An attacker fully controls firmware section header fields (data.start/end versus va.start/end); once a malicious blob is in the firmware path, parsing deterministically performs an oversized memcpy and, with ZERO set, an underflowed memset on every load and on GPU-reset reloads without races or uncontrollable layout.\nPR:L - The parser performs no capability or authentication checks on firmware content; on Mali CSF Android, Chromebook, and embedded deployments the GPU firmware image commonly lives on vendor/firmware partitions writable by local non-root system or vendor service accounts, sufficient to plant the crafted blob before driver probe.\nUI:N - After the malicious firmware file is in place, parsing runs automatically at driver probe or GPU-reset section reload with no separate victim action; an attacker does not need another user to open a device node or mount a filesystem to trigger the bug.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security domain; it does not cross a VM, IOMMU, or sandbox boundary such as guest-to-host escape.\nC:H - The unchecked memcpy copies attacker-controlled firmware bytes past the allocated shmem BO mapping, and the memset length underflow can zero far beyond the buffer, giving out-of-bounds read/write primitives over adjacent kernel heap objects rather than a bounded leak.\nI:H - Heap buffer overflow plus attacker-controlled firmware content enables arbitrary kernel memory corruption; the ZERO-flag memset underflow can perform a massive out-of-bounds zero write exploitable for control-flow hijacking and local privilege escalation.\nA:H - Oversized memcpy and underflowed memset corrupt kernel heap memory and can immediately kernel oops or panic; the same corruption is re-triggered on GPU reset via panthor_reload_fw_sections(), enabling repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:23.139Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e57165ca025a67d8dfd17efd2765fdd4925fdab"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a761b9be5863e1d26a584f0c2d1e114a684ed9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f4674d986c15c74327cb6ac6e2e2afecf061e04"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3caaa06809248b996254be5b47e10804a3494e2"
        }
      ],
      "title": "drm/panthor: reject firmware sections with oversized data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74452",
    "datePublished": "2026-08-15T12:26:56.331Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-17T05:47:23.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CERTFR-2026-AVI-1090

Solutions

CVE-2026-74442 (GCVE-0-2026-74442)

CVE-2026-74443 (GCVE-0-2026-74443)

CVE-2026-74444 (GCVE-0-2026-74444)

CVE-2026-74445 (GCVE-0-2026-74445)

CVE-2026-74446 (GCVE-0-2026-74446)

CVE-2026-74447 (GCVE-0-2026-74447)

CVE-2026-74448 (GCVE-0-2026-74448)

CVE-2026-74450 (GCVE-0-2026-74450)

CVE-2026-74451 (GCVE-0-2026-74451)

CVE-2026-74452 (GCVE-0-2026-74452)

Tags

Sightings

Nomenclature