CVE-2026-68259 drm/amdkfd: Check bounds in allocate_event_notification_slot
A missing bounds check in the Linux kernel's AMD KFD driver allows local attackers to trigger memory corruption or denial of service via crafted event IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68259?
CVE-2026-68259 is a missing authorization vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check bounds in allocate_event_notification_slot
The valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT
allocate_event_notification_slot has an option to specify an event id to allocate at, used by CRIU. We weren't checking the bounds on that value.
Check them.
v2: Lower bounds check is unecessary because of idr_alloc already rejecting negative numbers. Upper bounds check should be KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might not yet exist
(cherry picked from commit 6853f1f6cbbeb3f53ebbbd7286536aeb2c5d5f50)
Which versions are affected by CVE-2026-68259?
How do I fix CVE-2026-68259?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-68259 being exploited?
There is no known exploitation of CVE-2026-68259 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68259, DEBIAN-CVE-2026-68259, GHSA-3gmf-h2jg-hwv2, UBUNTU-CVE-2026-68259.