Cloudanix VulnDB

CVE-2026-68259

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in the Linux graphics driver could let a program on the same computer send bad data that crashes the system or lets it take control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing upper bounds validation on a caller-specified event identifier passed to allocate_event_notification_slot allows an out-of-range value to be used for KFD signal event mappings.

Why it matters to the business

Local users or containers can trigger kernel memory corruption or invalid accesses, leading to system instability, crashes, or potential privilege escalation on affected Linux systems.

How an attack unfolds

An attacker with local access invokes the KFD ioctl path used by CRIU, supplying an event identifier larger than KFD_SIGNAL_EVENT_LIMIT; the kernel proceeds without the missing bounds check and performs unsafe mapping or notification operations.

How to fix it

Apply the upstream kernel patch that adds the upper bounds check against KFD_SIGNAL_EVENT_LIMIT before any event allocation; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm the presence of the bounds check in allocate_event_notification_slot in the running kernel source or binary; test that requests with event ids exceeding KFD_SIGNAL_EVENT_LIMIT are rejected.

Typical attack path

  1. Obtain local unprivileged access on a system running the vulnerable kernel
  2. Load or interact with the amdkfd driver via userspace KFD APIs
  3. Issue an allocate_event_notification_slot request with an oversized event id via the CRIU-compatible interface
  4. Trigger subsequent signal or notification handling that dereferences the invalid mapping

How to detect it

Review kernel logs for KFD event allocation failures or out-of-bounds warnings after applying the patch; examine audit logs for unusual CRIU or KFD ioctl activity from non-root processes.

What your security team should do

  • Prioritize kernel updates on any systems exposing the amdkfd driver to untrusted local users
  • Restrict access to KFD device nodes via permissions or SELinux policies until patches are applied
  • Monitor for new kernel releases containing commit 6853f1f6cbbeb3f53ebbbd7286536aeb2c5d5f50

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocate_event_notification_slot The valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT allocate_event_notification_slot has an option to specify an event id to allocate at, used by CRIU. We weren't checking the bounds on that value. Check them. v2: Lower bounds check is unecessary because of idr_alloc already rejecting negative numbers. Upper bounds check should be KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might not yet exist (cherry picked from commit 6853f1f6cbbeb3f53ebbbd7286536aeb2c5d5f50)

Affected packages

Ecosystem Package Introduced Fixed