SB20261015161 - Integer underflow in Linux kernel amd amdkfd driver

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-98176)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to produce an incorrect EOP ring size field value.

The vulnerability exists due to integer underflow in the drm/amdkfd update_mqd() functions when calculating the EOP ring size field using an ffs() result of zero or one. A local user can trigger the affected calculation to produce an incorrect EOP ring size field value.

The advisory describes a theoretical condition: in practice, the ring buffer size cannot be less than 4096 bytes. It does not establish a reachable exploitation scenario.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1
• https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8