CVE-2026-68257
- Source
- https://cve.org/CVERecord?id=CVE-2026-68257
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68257.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-68257
- Downstream
BELL (1)
CLSA (1)
DEBIAN (1)
MGASA (2)
openSUSE (1)
RHSA (2)
RLSA (2)
SUSE (6)
- Related
- Published
- 2026-08-10T12:01:30Z
- Modified
- 2026-10-24T02:30:43Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns.
Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers().
(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68257.json" }- References
-
- https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b
- https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849
- https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467
- https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68257.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-68257
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced325aa07165394b8e866ffe9ec1d4c99d9195b2f2Fixedb88ffe6593607364a8c06a48c6f29e55437cdf8e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd15deafab5d722afb9e2f83c5edcdef9d9d98bd1Fixedabce3276c57e36c955627307469b9f009057a467Fixed865532d54eb57b660b1cb1b0e1755776ce21b849Fixed2b0386d4293920e690c0e017708f999b93cc729b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.59Fixed6.12.101
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.17.9Fixed6.18
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced63600103d2ac5c09fdeec5b931b396e4e0efd5d8
Affected versions
v6.*
v6.12.100
v6.12.59
v6.12.60
v6.12.61
v6.12.62
v6.12.63
v6.12.64
v6.12.65
v6.12.66
v6.12.67
v6.12.68
v6.12.69
v6.12.70
v6.12.71
v6.12.72
v6.12.73
v6.12.74
v6.12.75
v6.12.76
v6.12.77
v6.12.78
v6.12.79
v6.12.80
v6.12.81
v6.12.82
v6.12.83
v6.12.84
v6.12.85
v6.12.86
v6.12.87
v6.12.88
v6.12.89
v6.12.90
v6.12.91
v6.12.92
v6.12.93
v6.12.94
v6.12.95
v6.12.96
v6.12.97
v6.12.98
v6.12.99
v6.17.10
v6.17.11
v6.17.12
v6.17.13
v6.17.9