CVE-2026-68257: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns.
Promote totalcwsrsize to u64 and use checkaddoverflow()/ checkmuloverflow() in both kfdqueueacquirebuffers() and kfdqueuereleasebuffers().
(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68257?
CVE-2026-68257 has a risk score of 51.
What systems are affected by CVE-2026-68257?
CVE-2026-68257 affects the Linux kernel, specifically the amdkfd driver.
How do I fix CVE-2026-68257?
To fix CVE-2026-68257, update to the latest version of the Linux kernel that addresses the vulnerability.
What type of vulnerability is CVE-2026-68257?
CVE-2026-68257 is related to a 32-bit overflow issue in the total size calculation for CWSR.
What can happen if CVE-2026-68257 is exploited?
Exploitation of CVE-2026-68257 could lead to improper memory allocation and potential system instability.