High · published May 6, 2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8
bytes via memset without checking the buffer size parameter. This allows
unprivileged userspace to trigger an out-of bounds kernel memory write
by passing a small buffer, leading to potential privilege
escalation.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.17, < 5.10.252 | 5.10.252 |
| linux/linux_kernel | ≥ 5.11, < 5.15.202 | 5.15.202 |
| linux/linux_kernel | ≥ 5.16, < 6.1.165 | 6.1.165 |
| linux/linux_kernel | ≥ 6.2, < 6.6.128 | 6.6.128 |
| linux/linux_kernel | ≥ 6.7, < 6.12.75 | 6.12.75 |
| linux/linux_kernel | ≥ 6.13, < 6.18.16 | 6.18.16 |
| linux/linux_kernel | ≥ 6.19, < 6.19.6 | 6.19.6 |