CVE-2026-68257

What it actually does

32-bit integer overflow in total_cwsr_size calculation allows multiplication of ctx_save_restore_area_size and debug_memory_size by XCC count to wrap, producing an undersized CWSR allocation that firmware later overruns.

Why it matters to the business

Systems using AMD GPUs with large context save areas may experience kernel memory corruption, leading to crashes, instability, or potential code execution in compute workloads.

How an attack unfolds

An attacker crafts or triggers workloads that request large ctx_save_restore_area_size and debug_memory_size values; the 32-bit multiplication wraps, the kernel allocates a too-small CWSR buffer, and firmware writes beyond its bounds during context save/restore.

How to fix it

Apply the upstream fix that promotes total_cwsr_size to u64 and replaces arithmetic with check_add_overflow/check_mul_overflow in kfd_queue_acquire_buffers and kfd_queue_release_buffers; update to a kernel containing commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608 or later.

How to confirm the fix worked

Confirm the presence of the u64 promotion and overflow-checked arithmetic in kfd_queue_acquire_buffers and kfd_queue_release_buffers; test allocation paths with large ctx_save_restore_area_size and debug_memory_size values multiplied by XCC count to verify no wrap occurs.

Typical attack path

1. Identify or create a process that exercises AMD KFD queue buffer acquisition with large debug and context sizes
2. Trigger kfd_queue_acquire_buffers so the 32-bit product wraps
3. Force firmware to perform CWSR operations that overrun the undersized buffer
4. Leverage the resulting memory corruption for further exploitation or denial of service

How to detect it

Inspect kernel logs for KFD buffer allocation failures or firmware overrun messages; correlate with processes using large ctx_save_restore_area_size or debug_memory_size values on AMD hardware.

What your security team should do

• Prioritize kernel updates on all AMD GPU compute nodes within standard patch windows
• Monitor for unexpected KFD-related kernel panics or firmware errors on systems with high context memory usage
• Review workloads that request large debug or context save areas for necessity