{"api_version":"1","generated_at":"2026-08-16T08:17:47+00:00","cve":"CVE-2026-68257","urls":{"html":"https://cve.report/CVE-2026-68257","api":"https://cve.report/api/cve/CVE-2026-68257.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68257","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68257"},"summary":{"title":"drm/amdkfd: fix 32-bit overflow in CWSR total size calculation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix 32-bit overflow in CWSR total size calculation\n\ntotal_cwsr_size was computed in 32-bit before being used as a BO/SVM\nallocation size.\nWith large ctx_save_restore_area_size and debug_memory_size\nmultiplied by the XCC count, the product can wrap,\nyielding an undersized CWSR save area that firmware later overruns.\n\nPromote total_cwsr_size to u64 and use check_add_overflow()/\ncheck_mul_overflow() in both kfd_queue_acquire_buffers() and\nkfd_queue_release_buffers().\n\n(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:14","updated_at":"2026-08-13 23:17:26"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849","name":"https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e","name":"https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467","name":"https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b","name":"https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68257","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68257","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 b88ffe6593607364a8c06a48c6f29e55437cdf8e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 abce3276c57e36c955627307469b9f009057a467 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 865532d54eb57b660b1cb1b0e1755776ce21b849 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2b0386d4293920e690c0e017708f999b93cc729b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.101 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.42 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68257","cve":"CVE-2026-68257","epss":"0.001380000","percentile":"0.036370000","score_date":"2026-08-15","updated_at":"2026-08-16 00:00:38"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b88ffe6593607364a8c06a48c6f29e55437cdf8e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"abce3276c57e36c955627307469b9f009057a467","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"865532d54eb57b660b1cb1b0e1755776ce21b849","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"2b0386d4293920e690c0e017708f999b93cc729b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6.12.101","status":"affected","version":"0","versionType":"semver"},{"lessThan":"6.18.42","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.1.6","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix 32-bit overflow in CWSR total size calculation\n\ntotal_cwsr_size was computed in 32-bit before being used as a BO/SVM\nallocation size.\nWith large ctx_save_restore_area_size and debug_memory_size\nmultiplied by the XCC count, the product can wrap,\nyielding an undersized CWSR save area that firmware later overruns.\n\nPromote total_cwsr_size to u64 and use check_add_overflow()/\ncheck_mul_overflow() in both kfd_queue_acquire_buffers() and\nkfd_queue_release_buffers().\n\n(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Triggered through the AMDKFD_IOC_CREATE_QUEUE ioctl on the local /dev/kfd character device; the attacker-controlled ctx_save_restore_size field comes straight from the ioctl argument struct with no remote reachability.\nAC:L - The overflow is pure deterministic arithmetic on a value the attacker fully controls — passing ctx_save_restore_size near 2^32 (or /NUM_XCC on multi-XCC MI300 parts) reliably wraps total_cwsr_size to 0 or a small value on every attempt, with no race or layout dependency.\nPR:L - Requires only an unprivileged local account with access to /dev/kfd, which is granted to the render group and is routinely available to ordinary users on ROCm hosts, GPU compute nodes, containers, Steam Deck/desktop and Chrome OS style systems; no capabilities are checked on this path.\nUI:N - The attacker creates the malicious compute queue entirely from its own process via a single ioctl; no action by any other user or administrator is needed.\nS:U - The undersized CWSR area and the resulting firmware overrun stay within the kernel/GPU driver security authority of the same machine; there is no hypervisor or IOMMU boundary crossed.\nC:H - With validation bypassed, CP firmware save/restore reads span memory adjacent to the tiny validated buffer and load it into wave state the attacker's shader can read back, and get_wave_state copies per-XCC control-stack contents out of the unvalidated region, giving a broad out-of-bounds disclosure primitive.\nI:H - The queue is programmed with the full unwrapped save size and per-XCC base offsets, so firmware performs large out-of-bounds writes of wave/control-stack data beyond the buffer that was actually validated and reference-counted, and the bypassed queue_refcount lets those buffers be unmapped or freed while the queue is live — an attacker-influenced memory-corruption primitive.\nA:H - Overrunning the CWSR save area drives the GPU into unmapped VA on preemption, causing VM faults, queue hangs and driver-initiated GPU resets that take down all GPU workloads on the machine, including other tenants on shared compute nodes."}]}],"providerMetadata":{"dateUpdated":"2026-08-13T22:42:24.041Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e"},{"url":"https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467"},{"url":"https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849"},{"url":"https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b"}],"title":"drm/amdkfd: fix 32-bit overflow in CWSR total size calculation","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68257","datePublished":"2026-08-10T12:01:30.547Z","dateReserved":"2026-07-30T09:28:09.378Z","dateUpdated":"2026-08-13T22:42:24.041Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:14","lastModifiedDate":"2026-08-13 23:17:26","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68257","Ordinal":"1","Title":"drm/amdkfd: fix 32-bit overflow in CWSR total size calculation","CVE":"CVE-2026-68257","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68257","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix 32-bit overflow in CWSR total size calculation\n\ntotal_cwsr_size was computed in 32-bit before being used as a BO/SVM\nallocation size.\nWith large ctx_save_restore_area_size and debug_memory_size\nmultiplied by the XCC count, the product can wrap,\nyielding an undersized CWSR save area that firmware later overruns.\n\nPromote total_cwsr_size to u64 and use check_add_overflow()/\ncheck_mul_overflow() in both kfd_queue_acquire_buffers() and\nkfd_queue_release_buffers().\n\n(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)","Type":"Description","Title":"drm/amdkfd: fix 32-bit overflow in CWSR total size calculation"}]}}}