CVE-2026-97496

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix OOB memory exposure in get_wave_state()

The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and

cp_hqd_cntl_stack_offset values read directly from the MQD, which are

written by GPU microcode and fully attacker-controlled on the

CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3).

this leads to an unbounded copy_to_user() that can leak adjacent

GTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB

read length, if size is set to 1 MiB against a 4 KiB allocation, we leak

1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR

pointers).

Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated

buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the

clamped size before performing arithmetic and copy_to_user().

This ensures we never read beyond the allocated kernel BO regardless of

attacker-supplied MQD field values.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References