CVE-2026-74447

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

eop_ring_buffer_size in struct queue_properties is a u32. In

kfd_queue_acquire_buffers() the expected EOP buffer size is computed as

ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the

addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to

0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on

size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD

cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB

BO, so CP EOP writes can land past the buffer and fault the GPU.

Cast the operand to u64 so the alignment is computed in 64-bit; the size

check in kfd_queue_buffer_get() then rejects the oversized request.

(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References