CVE-2026-68258 (GCVE-0-2026-68258)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-18 06:55
VLAI
Title
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided type is less than it. For mqd_size, add new function mqd_size_from_queue_type and confirm that the provided mqd_size matches expectations. (cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 42c6c48214b726c30918e8dc80e2168607d13ae4 , < fd1691ec62701c982ea32e749678988c67fd4c21 (git)
Affected: 42c6c48214b726c30918e8dc80e2168607d13ae4 , < cc10a5839756982504ee8568fc1e1625962ab7f8 (git)
Affected: 42c6c48214b726c30918e8dc80e2168607d13ae4 , < 47ea05f246bebc81c7796f56265cffd812cf0601 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h",
            "drivers/gpu/drm/amd/amdkfd/kfd_priv.h",
            "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd1691ec62701c982ea32e749678988c67fd4c21",
              "status": "affected",
              "version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
              "versionType": "git"
            },
            {
              "lessThan": "cc10a5839756982504ee8568fc1e1625962ab7f8",
              "status": "affected",
              "version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
              "versionType": "git"
            },
            {
              "lessThan": "47ea05f246bebc81c7796f56265cffd812cf0601",
              "status": "affected",
              "version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h",
            "drivers/gpu/drm/amd/amdkfd/kfd_priv.h",
            "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds on CRIU restore queue type and mqd size\n\nWe weren\u0027t checking whether the values provided in the private\ndata in kfd CRIU restore were within bounds.\n\nFor queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided\ntype is less than it.\n\nFor mqd_size, add new function mqd_size_from_queue_type and confirm\nthat the provided mqd_size matches expectations.\n\n(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the AMDKFD_IOC_CRIU_OP ioctl on the local /dev/kfd character device; there is no remote or adjacent-network path into amdkfd CRIU restore handling.\nAC:L - The attacker directly supplies mqd_size and type in the CRIU private data, so a single ioctl deterministically triggers the over-read or the ZERO_SIZE_PTR dereference; restore runs under p-\u003emutex so no race must be won.\nPR:L - The attacker needs /dev/kfd access (render group) plus CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN; CAP_CHECKPOINT_RESTORE is a delegated, non-root capability routinely granted to CRIU tooling and container checkpoint/restore services, so this is a limited privilege rather than full administrative control.\nUI:N - The attacker issues the CRIU restore and checkpoint ioctls entirely against its own KFD process context; no action by another user or victim process is required.\nS:U - The out-of-bounds read and resulting crash stay within the kernel\u0027s own security authority on the host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - restore_mqd() memcpy\u0027s a full ASIC MQD (e.g. sizeof(struct v9_mqd)) out of a kmalloc buffer sized by the attacker\u0027s smaller mqd_size, and criu_checkpoint_queues_device() then copies the entire MQD back to userspace, disclosing adjacent kernel slab contents.\nI:N - The destination MQD buffer is allocated by the mqd manager at its own correct size and ctl_stack_size is validated against node_props, so nothing is written out of bounds; the defect is purely a source-side over-read.\nA:H - With mqd_size and ctl_stack_size both zero, kmalloc(0) returns ZERO_SIZE_PTR and the memcpy faults reading address 0x10 while dqm_lock is held, oopsing the kernel; an out-of-range queue type also trips WARN(), panicking systems with panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:55:55.677Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd1691ec62701c982ea32e749678988c67fd4c21"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc10a5839756982504ee8568fc1e1625962ab7f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/47ea05f246bebc81c7796f56265cffd812cf0601"
        }
      ],
      "title": "drm/amdkfd: Check bounds on CRIU restore queue type and mqd size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68258",
    "datePublished": "2026-08-10T12:01:32.149Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-18T06:55:55.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68258",
      "date": "2026-08-20",
      "epss": "0.00129",
      "percentile": "0.03009"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68258\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:14.483\",\"lastModified\":\"2026-08-18T07:16:51.497\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdkfd: Check bounds on CRIU restore queue type and mqd size\\n\\nWe weren\u0027t checking whether the values provided in the private\\ndata in kfd CRIU restore were within bounds.\\n\\nFor queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided\\ntype is less than it.\\n\\nFor mqd_size, add new function mqd_size_from_queue_type and confirm\\nthat the provided mqd_size matches expectations.\\n\\n(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\",\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h\",\"drivers/gpu/drm/amd/amdkfd/kfd_priv.h\",\"drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"42c6c48214b726c30918e8dc80e2168607d13ae4\",\"lessThan\":\"fd1691ec62701c982ea32e749678988c67fd4c21\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42c6c48214b726c30918e8dc80e2168607d13ae4\",\"lessThan\":\"cc10a5839756982504ee8568fc1e1625962ab7f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42c6c48214b726c30918e8dc80e2168607d13ae4\",\"lessThan\":\"47ea05f246bebc81c7796f56265cffd812cf0601\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\",\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h\",\"drivers/gpu/drm/amd/amdkfd/kfd_priv.h\",\"drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47ea05f246bebc81c7796f56265cffd812cf0601\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc10a5839756982504ee8568fc1e1625962ab7f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd1691ec62701c982ea32e749678988c67fd4c21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T17:30:10+00:00",
      "cve": "CVE-2026-68258",
      "id": "CVE-2026-68258",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68258.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.