Integer underflow in Linux kernel - CVE-2026-98177
Published: October 15, 2026
Vulnerability identifier: #VU155944
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98177
CWE-ID: CWE-191
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to potentially cause an incorrect EOP ring size calculation.
The vulnerability exists due to integer underflow in the AMD KFD EOP ring size calculation when subtracting one from an order_base_2 result of zero. A local user can potentially trigger this arithmetic condition to cause an incorrect EOP ring size calculation.
The advisory describes this condition as theoretical because the ring buffer size cannot be less than 4096 bytes in practice.
Affected software
Linux kernel
How to mitigate CVE-2026-98177
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3