What’s Vulnerable › Vulnerabilities

CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-26
• Weakness: CWE-190

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t build. using array_size() instead, it saturates to SIZE_MAX on overflow. (cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285)

Affected products

• Linux kernel: from 6.5 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.35; from 6.19 before 7.0.12; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5 — fixed in 6.6.143, 6.12.93, 6.18.35, 7.0.12
• Linux kernel: 6.5 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 6.6.143, 6.12.93, 6.18.35, 7.0.12; Linux kernel 7.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/4e5f808b454167cc58d7084a407a554d8ddc694d
• https://git.kernel.org/stable/c/4f9eeedc3d3151f8a226fd676c314a813edda5a1
• https://git.kernel.org/stable/c/5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c
• https://git.kernel.org/stable/c/93f5534b35a05ef8a0109c1eefa800062fee810a
• https://git.kernel.org/stable/c/de70a80992396ee306ee3a2810ad28aa1608ba9b

Get alerted when CVE-2026-63881 or the next vulnerability affects your stack