CVE-2026-97496

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdkfd: Fix OOB memory exposure in get_wave_state()<br /> <br /> The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and<br /> cp_hqd_cntl_stack_offset values read directly from the MQD, which are<br /> written by GPU microcode and fully attacker-controlled on the<br /> CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3).<br /> <br /> this leads to an unbounded copy_to_user() that can leak adjacent<br /> GTT/kernel memory. If offset &gt; size, integer underflow produces a ~4 GiB<br /> read length, if size is set to 1 MiB against a 4 KiB allocation, we leak<br /> 1 MiB of adjacent kernel memory (other queues&amp;#39; MQDs, ring buffers, KASLR<br /> pointers).<br /> <br /> Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated<br /> buffer size (q-&gt;ctl_stack_size) and cp_hqd_cntl_stack_offset to the<br /> clamped size before performing arithmetic and copy_to_user().<br /> <br /> This ensures we never read beyond the allocated kernel BO regardless of<br /> attacker-supplied MQD field values.