CVE-2026-74357

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

The ring content dump in amdgpu_coredump() uses two separate loops over

adev->rings[]: the first counts rings with unsignalled fences to size

the allocation, and the second copies ring data into the allocated

buffers.

Both loops use the same condition to skip rings:

atomic_read(&ring->fence_drv.last_seq) == ring->fence_drv.sync_seq

Because last_seq is an atomic that is updated concurrently by the fence

signalling path, additional rings may appear unsignalled in the second

loop that were signalled during the first. When this happens, idx

exceeds the allocated ring_count and the store to coredump->rings[idx]

writes past the end of the kcalloc-ed buffer.

This was found during IGT stressful test amd_queue_reset which

triggers random GPU resets. The OVERSIZE subtest

(CMD_STREAM_EXEC_INVALID_PACKET_LENGTH_OVERSIZE on GFX ring) provokes

a ring tim

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References