CVE-2026-98177

What it actually does

The vulnerability allowed a potential integer underflow when computing the base-2 logarithm of the EOP ring buffer size in the AMD KFD driver, which could result in an invalid ring control value being written to hardware registers and subsequent memory corruption in kernel space.

Why it matters to the business

Unpatched Linux systems with AMD GPUs could experience kernel crashes, denial of service, or local privilege escalation, disrupting workloads that rely on GPU compute or graphics and requiring emergency kernel updates across server and workstation fleets.

How an attack unfolds

An attacker with local access crafts a userspace queue whose EOP ring buffer size triggers the underflow path in the order_base_2 calculation, causing an out-of-bounds or negative ring size to be programmed; subsequent GPU command submission then writes beyond intended kernel memory regions.

How to fix it

Apply the upstream kernel patch that replaces the original order_base_2 expression with order_base_2(q->eop_ring_buffer_size / 8) and update the explanatory comment; rebuild and deploy the fixed kernel to all affected systems.

How to confirm the fix worked

Confirm the corrected calculation appears in the amdkfd source, verify that ring sizes below 4096 bytes are rejected or handled safely, and test GPU queue creation on patched kernels to ensure no underflow occurs.

Typical attack path

1. Obtain local unprivileged access on a Linux system with an AMD GPU and the amdkfd driver loaded.
2. Create or manipulate a compute or graphics queue with a specially sized EOP ring buffer.
3. Trigger the EOP ring size calculation path in drm/amdkfd.
4. Cause the underflowed value to be written to cp_hqd_eop_control.
5. Submit GPU work that leverages the corrupted ring state to corrupt adjacent kernel memory.
6. Escalate privileges or crash the system via the resulting memory corruption.

How to detect it

Review kernel logs for amdkfd errors or warnings around EOP ring initialization, inspect dmesg output after GPU queue creation attempts, and correlate with any unexplained kernel panics on AMD GPU systems shortly after process startup.

What your security team should do

• Prioritize kernel updates on all systems exposing AMD GPUs to untrusted users or workloads.
• Monitor vendor and distribution advisories for backported fixes in supported LTS kernels.
• Restrict unprivileged access to GPU devices via device permissions until patches are applied.