UBUNTU-CVE-2026-98176: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffs(q->eopringbuffersize / sizeof(unsigned int)) - 1 - 1 But ffs can in theory return 1 or 0, so this could underflow (although in practice the ring buffer size cannot be less than 4096). Change this to ffs(q->eopringbuffersize / sizeof(unsigned int) / 4) using properties of logarithms. (cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 4f18c56630383c14bfc6b2d65f88f2f895d2121a
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are in scope, but exploitation requires local access with low privileges. The affected code is in the AMD KFD DRM component, so exposure is relevant to systems using that kernel functionality.
What does an attacker need to exploit it?
The supplied vector indicates local attack access, low privileges, and no user interaction. The description does not identify a remote attack path or any cross-security-boundary impact.
How serious is the available impact?
The stated severity is medium with a 4.8 score. The vector identifies availability impact as low and reports no confidentiality or integrity impact.
Is the underflow reachable with normal EOP ring buffer sizes?
The description says that, in practice, the ring buffer size cannot be less than 4096, despite the theoretical possibility that ffs could return 1 or 0. This suggests the problematic condition is not expected for the normal ring buffer size constraint described.