SB2026050283 - Incorrect Calculation of Buffer Size in Linux kernel amd amdkfd driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-31765)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource size calculation in the amdgpu KFD GPU virtual memory allocation logic when initializing GPU virtual memory on 64K page-size systems. A local user can invoke the affected ioctl path to trigger a kernel crash.

The issue is triggered on systems using 64K pages because the allocated trap buffer size can exceed the reserved trap area size.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4487571ef17a30d274600b3bd6965f497a881299
• https://git.kernel.org/stable/c/6b2614a0ff05a2d2836311425091c8feca6f0c21
• https://git.kernel.org/stable/c/77c918eaa4c916751769242567407f61c6af142a
• https://git.kernel.org/stable/c/d3508cf822c4d96d3e492210314f8f6f2da7df58