Out-of-bounds read in Linux kernel - CVE-2026-97496
Published: September 24, 2026
Vulnerability identifier: #VU151987
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-97496
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the get_wave_state() function in drm/amdkfd when handling CRIU restore operations through AMDKFD_IOC_RESTORE_PROCESS with H3. A local user can supply crafted MQD control stack size and offset values to disclose sensitive information.
The exposed data can include adjacent GTT or kernel memory, such as other queues' MQDs, ring buffers, and KASLR pointers.
Affected software
Linux kernel
How to mitigate CVE-2026-97496
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3