CVE-2026-97496 is a vulnerability in Linux Kernel
Published on September 24, 2026
drm/amdkfd: Fix OOB memory exposure in get_wave_state()
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix OOB memory exposure in get_wave_state()
The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and
cp_hqd_cntl_stack_offset values read directly from the MQD, which are
written by GPU microcode and fully attacker-controlled on the
CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3).
this leads to an unbounded copy_to_user() that can leak adjacent
GTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB
read length, if size is set to 1 MiB against a 4 KiB allocation, we leak
1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR
pointers).
Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated
buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the
clamped size before performing arithmetic and copy_to_user().
This ensures we never read beyond the allocated kernel BO regardless of
attacker-supplied MQD field values.
Products Associated with CVE-2026-97496
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below d9183d974ddd5f09d029beaf359275ac20d4d5fe is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below ec646686613d8ab05b282d1463a7baa49fd6b83b is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 7ef144458f48d5589e36f1b3d83e83db2e5c5ba5 is affected.
- Before 6.12.111 is affected.
- Before 6.18.53 is affected.
- Version 6.12.111, <= 6.12.* is unaffected.
- Version 6.18.53, <= 6.18.* is unaffected.
- Version 7.2, <= * is unaffected.