CVE-2026-68257 drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
A 32-bit integer overflow in the Linux kernel's AMD KFD driver allows undersized memory allocations, potentially leading to buffer overruns and code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68257?
CVE-2026-68257 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns.
Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers().
(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
Weakness: CWE-190
Which versions are affected by CVE-2026-68257?
How do I fix CVE-2026-68257?
Apply the vendor's patch.
Is CVE-2026-68257 being exploited?
There is no known exploitation of CVE-2026-68257 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68257, DEBIAN-CVE-2026-68257, GHSA-rqrw-7v4f-gfw3, UBUNTU-CVE-2026-68257.