CVE-2026-68257

drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns.

Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers().

(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	325aa07165394b8e866ffe9ec1d4c99d9195b2f2 to before b88ffe6593607364a8c06a48c6f29e55437cdf8eAffected d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 to before abce3276c57e36c955627307469b9f009057a467Affected d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 to before 865532d54eb57b660b1cb1b0e1755776ce21b849Affected d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 to before 2b0386d4293920e690c0e017708f999b93cc729bAffected 63600103d2ac5c09fdeec5b931b396e4e0efd5d8Affected 6.12.59 to before 6.12.101Affected 6.17.9 to before 6.18Affected
LinuxLinux	6.18Affected before 6.18Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

325aa07165394b8e866ffe9ec1d4c99d9195b2f2 to before b88ffe6593607364a8c06a48c6f29e55437cdf8eAffected
d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 to before abce3276c57e36c955627307469b9f009057a467Affected
d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 to before 865532d54eb57b660b1cb1b0e1755776ce21b849Affected
d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 to before 2b0386d4293920e690c0e017708f999b93cc729bAffected
63600103d2ac5c09fdeec5b931b396e4e0efd5d8Affected
6.12.59 to before 6.12.101Affected
6.17.9 to before 6.18Affected

LinuxLinux

6.18Affected
before 6.18Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.