CVE-2026-80747

drm/amdkfd: Add bounds check for CRAT subtype length

State: Published
Severity: 8.0 High
Published: Sep 3, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Add bounds check for CRAT subtype length

The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures.

Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents.

(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 1f9cc5375916b57acb1ad4443af7b4dbf347638aAffected 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before fef8c8afcb85dce5ff115f82a148cdf87a9617b9Affected 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 77b659fb104eb069ea7a61960699e4d1eea6567aAffected 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 69164d6bdad5d6657e51436a3f602822f620a46aAffected 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before ca91e0cc8087568e4b791648a7c01e804f48cb73Affected 5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 6e7566ba4739dd573c331adde1c96690f7a567bdAffected
LinuxLinux	3.19Affected before 3.19Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 1f9cc5375916b57acb1ad4443af7b4dbf347638aAffected
5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before fef8c8afcb85dce5ff115f82a148cdf87a9617b9Affected
5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 77b659fb104eb069ea7a61960699e4d1eea6567aAffected
5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 69164d6bdad5d6657e51436a3f602822f620a46aAffected
5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before ca91e0cc8087568e4b791648a7c01e804f48cb73Affected
5b5c4e40a37e858e2bff8cd91be8e972256392c4 to before 6e7566ba4739dd573c331adde1c96690f7a567bdAffected

LinuxLinux

3.19Affected
before 3.19Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.