CVE-2026-97496

CVE CVE-2026-97496EUVD EUVD-2026-86094Published 2026-09-24T16:04:43.000ZLast changed 2026-09-25T05:10:51.000ZCVSS 7.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in get_wave_state() The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD, which are written by GPU microcode and fully attacker-controlled on the CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3). this leads to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB read length, if size is set to 1 MiB against a 4 KiB allocation, we leak 1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR pointers). Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the clamped size before performing arithmetic and copy_to_user(). This ensures we never read beyond the allocated kernel BO regardless of attacker-supplied MQD field values.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d9183d974ddd5f09d029beaf359275ac20d4d5fe; patch: 6.12.111; 0 <6.18.53; patch: 6.18.53; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ec646686613d8ab05b282d1463a7baa49fd6b83b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7ef144458f48d5589e36f1b3d83e83db2e5c5ba5; 0 <6.12.111; patch: 7.2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.