CVE-2026-45878

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

The address watch clear code receives watch_id as an unsigned value

(u32), but some helper functions were using a signed int and checked

bits by shifting with watch_id.

If a very large watch_id is passed from userspace, it can be converted

to a negative value. This can cause invalid shifts and may access

memory outside the watch_points array.

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before

using it. Also use BIT(watch_id) to test and clear bits safely.

This keeps the behavior unchanged for valid watch IDs and avoids

undefined behavior for invalid ones.

Fixes the below:

drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448

kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow

'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References