{"id":"CVE-2026-74447","summary":"drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment\n\neop_ring_buffer_size in struct queue_properties is a u32. In\nkfd_queue_acquire_buffers() the expected EOP buffer size is computed as\nALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the\naddition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to\n0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on\nsize != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD\ncp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB\nBO, so CP EOP writes can land past the buffer and fault the GPU.\n\nCast the operand to u64 so the alignment is computed in 64-bit; the size\ncheck in kfd_queue_buffer_get() then rejects the oversized request.\n\n(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)","modified":"2026-10-08T02:48:05.950762004Z","published":"2026-08-15T12:26:53.305Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74447.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/273548eb997c6be85230c1236b18784b09f6203c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6dc0b4b39ed4f11ef70f76ecea8537e35f45342b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961"},{"type":"WEB","url":"https://git.kernel.org/stable/c/83463a96ea3c7d8ae636a4d6a0ba63c9ce410724"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74447.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74447"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ee0dc6c66a913260311876a4b2b53fe0b9bc3f94"},{"fixed":"273548eb997c6be85230c1236b18784b09f6203c"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"acfc84cfa70aca5b970faf152979bc97b9f8b0c0"},{"fixed":"6dc0b4b39ed4f11ef70f76ecea8537e35f45342b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"42ea9cf2f16b7131cb7302acb3dac510968f8bdc"},{"fixed":"7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961"},{"fixed":"83463a96ea3c7d8ae636a4d6a0ba63c9ce410724"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.75"},{"fixed":"6.12.103"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.16"},{"fixed":"6.18.44"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.19.6"},{"fixed":"6.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c6ce687077cc67e4f3cbd0c89cb356fbbce91f4c"}]}],"versions":["v6.12.102","v6.12.101","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.12.96","v6.12.95","v6.12.94","v6.12.93","v6.12.92","v6.12.91","v6.12.90","v6.12.89","v6.12.88","v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.12.82","v6.12.81","v6.12.80","v6.12.79","v6.12.78","v6.12.77","v6.12.76","v6.12.75","v6.18.43","v6.18.42","v6.18.41","v6.18.40","v6.18.39","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v6.18.33","v6.18.32","v6.18.31","v6.18.30","v6.18.29","v6.18.28","v6.18.27","v6.18.26","v6.18.25","v6.18.24","v6.18.23","v6.18.22","v6.18.21","v6.18.20","v6.18.19","v6.18.18","v6.18.17","v6.18.16","v6.19.14","v6.19.13","v6.19.12","v6.19.11","v6.19.10","v6.19.9","v6.19.8","v6.19.7","v6.19.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74447.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74447.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}