SB20260924101 - Out-of-bounds read in Linux kernel amd amdkfd driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-97496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the get_wave_state() function in drm/amdkfd when handling CRIU restore operations through AMDKFD_IOC_RESTORE_PROCESS with H3. A local user can supply crafted MQD control stack size and offset values to disclose sensitive information.

The exposed data can include adjacent GTT or kernel memory, such as other queues' MQDs, ring buffers, and KASLR pointers.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5
• https://git.kernel.org/stable/c/d9183d974ddd5f09d029beaf359275ac20d4d5fe
• https://git.kernel.org/stable/c/ec646686613d8ab05b282d1463a7baa49fd6b83b