CVE-2026-68257
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers(). (cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
How to fix
- Linux Linuxb88ffe6593607364a8c06a48c6f29e55437cdf8e, abce3276c57e36c955627307469b9f009057a467, 865532d54eb57b660b1cb1b0e1755776ce21b849, 2b0386d4293920e690c0e017708f999b93cc729b, 6.12.101, 6.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 325aa07165394b8e866ffe9ec1d4c99d9195b2f2 ≤ v < b88ffe6593607364a8c06a48c6f29e55437cdf8e, d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 ≤ v < abce3276c57e36c955627307469b9f009057a467, d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 ≤ v < 865532d54eb57b660b1cb1b0e1755776ce21b849, d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 ≤ v < 2b0386d4293920e690c0e017708f999b93cc729b, 63600103d2ac5c09fdeec5b931b396e4e0efd5d8, 6.12.59 ≤ v < 6.12.101, 6.17.9 ≤ v < 6.18, 6.18 | b88ffe6593607364a8c06a48c6f29e55437cdf8e, abce3276c57e36c955627307469b9f009057a467, 865532d54eb57b660b1cb1b0e1755776ce21b849, 2b0386d4293920e690c0e017708f999b93cc729b, 6.12.101, 6.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.