CVE-2026-74447

CVE CVE-2026-74447EUVD EUVD-2026-59754Published 2026-08-15T12:26:53.000ZLast changed 2026-08-17T05:47:18.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU. Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request. (cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 6.18.44; acfc84cfa70aca5b970faf152979bc97b9f8b0c0 <6dc0b4b39ed4f11ef70f76ecea8537e35f45342b; 42ea9cf2f16b7131cb7302acb3dac510968f8bdc <7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961; patch: 7.2; patch: 0; 6.19.6 <6.20; patch: 7.1.8; 6.12.75 <6.12.103; 42ea9cf2f16b7131cb7302acb3dac510968f8bdc <83463a96ea3c7d8ae636a4d6a0ba63c9ce410724; 6.18.16 <6.18.44; c6ce687077cc67e4f3cbd0c89cb356fbbce91f4c; 7.0; patch: 6.12.103; ee0dc6c66a913260311876a4b2b53fe0b9bc3f94 <273548eb997c6be85230c1236b18784b09f6203c

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.