Cloudanix VulnDB

CVE-2026-98176

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Linux received a small fix that prevents a rare math mistake when setting up memory rings for certain AMD graphics cards used in computing tasks.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Potential integer underflow when computing base-2 log of EOP ring size via ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 2, which could produce an invalid cp_hqd_eop_control value if ffs returns 0 or 1.

Why it matters to the business

Rare instability or misconfiguration in AMD GPU compute workloads on Linux kernels, increasing operational risk for HPC or graphics-heavy environments until patched.

How an attack unfolds

An attacker would attempt to allocate an EOP ring buffer smaller than the documented minimum to force ffs to return a low value, triggering underflow during ring control register setup in amdkfd and resulting in driver or GPU state corruption.

How to fix it

Apply the upstream fix (commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a) or any vendor kernel that replaces the original ffs expression with ffs(size / 4).

How to confirm the fix worked

Inspect the amdkfd source for the updated ring-size logarithm calculation and confirm the patch is present in the running kernel via version string or source audit.

Typical attack path

  1. Locate a system running an unpatched Linux kernel with amdkfd loaded
  2. Trigger EOP ring allocation with a size that would cause ffs to return 0 or 1
  3. Observe resulting invalid ring size configuration or subsequent driver fault

How to detect it

Search kernel logs and crash dumps for amdkfd-related faults mentioning EOP ring size or cp_hqd_eop_control around the time of GPU job submission.

What your security team should do

  • Prioritize kernel updates for systems with AMD GPUs used in compute workloads
  • Review change logs for amdkfd EOP ring handling in upcoming distro releases
  • Test GPU workloads after patching to verify ring configuration stability

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1 But ffs can in theory return 1 or 0, so this could underflow (although in practice the ring buffer size cannot be less than 4096). Change this to ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4) using properties of logarithms. (cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)

Affected packages

Ecosystem Package Introduced Fixed