CVE-2026-45853: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Use kvfree instead of kfree in amdgpugmcgetnpsmemranges()
amdgpudiscoverygetnpsinfo() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption.
Use kvfree() to safely handle both kmalloc and vmalloc allocations.
Compile tested only. Issue found using a prototype static analysis tool and code review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the drm/amdgpu code change to use kvfree() instead of kfree() when freeing memory allocated by amdgpu_discovery_get_nps_info() / amdgpu_gmc_get_nps_memranges(), because kfree() on vmalloc memory can lead to memory corruption.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45853?
CVE-2026-45853 has a severity rating of high with a CVSS score of 7.8.
How do I fix CVE-2026-45853?
To fix CVE-2026-45853, update the Linux kernel to a version that addresses this vulnerability.
What systems are affected by CVE-2026-45853?
CVE-2026-45853 affects the Linux kernel, specifically the amdgpu component.
What type of vulnerability is CVE-2026-45853?
CVE-2026-45853 is a memory handling vulnerability due to improper use of kfree instead of kvfree.
What could happen if CVE-2026-45853 is exploited?
If exploited, CVE-2026-45853 could lead to potential memory corruption and stability issues in affected systems.