CVE-2026-98177 drm/amdkfd: Avoid integer underflow in EOP ring size calculation.

Not scored Published 6 Oct 2026 Updated 19 Oct 2026

A local attacker with access to AMD GPU hardware could trigger an integer underflow in the kernel driver, potentially causing a system crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98177?

CVE-2026-98177 is a vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Avoid integer underflow in EOP ring size calculation.

The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as

order_base_2(q->eop_ring_buffer_size / 4) - 1

But order_base_2 can in theory return 0, so this could underflow (although in practice the ring buffer size cannot be less than 4096).

Change this to

order_base_2(q->eop_ring_buffer_size / 8)

using properties of logarithms.

Also add to the above comment to make the mathematics more clear.

(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)

Which versions are affected by CVE-2026-98177?

How do I fix CVE-2026-98177?

Apply the vendor's patch.

Is CVE-2026-98177 being exploited?

There is no known exploitation of CVE-2026-98177 in the wild and no public exploit code.

Sources

Also known as AZL-106287, BELL-CVE-2026-98177, DEBIAN-CVE-2026-98177, GHSA-w77g-jh5m-m588, UBUNTU-CVE-2026-98177.