CVE-2026-68447
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
12/08/2026
Última modificación:
18/08/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size<br />
<br />
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size<br />
from hardware without bounding it to the allocated BO region. If the HW<br />
field is larger than the queue&#39;s control stack allocation, memcpy reads<br />
past the BO into adjacent GTT memory and can leak kernel data to userspace.<br />
<br />
Store the page-aligned control stack BO size in mqd_manager and clamp<br />
checkpoint copies and reported checkpoint sizes to<br />
min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound<br />
for multi-XCC v9.4.3 checkpoint layout.<br />
<br />
(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)
Impacto
Puntuación base 3.x
7.10
Gravedad 3.x
ALTA