In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 5
- StatusReceived → PublishedNVD modified 2026-10-21 12:47
- References+2 references (now 5)NVD modified 2026-10-21 13:19
- StatusPublished → ReceivedNVD modified 2026-10-21 13:19
- StatusReceived → PublishedNVD modified 2026-10-21 12:47
- First seenCVSS 8.0NVD modified 2026-10-15 11:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://git.kernel.org/stable/c/69164d6bdad5d6657e51436a3f602822f620a46a
- https://git.kernel.org/stable/c/6e7566ba4739dd573c331adde1c96690f7a567bd
- https://git.kernel.org/stable/c/77b659fb104eb069ea7a61960699e4d1eea6567a
- https://git.kernel.org/stable/c/ca91e0cc8087568e4b791648a7c01e804f48cb73
- https://git.kernel.org/stable/c/fef8c8afcb85dce5ff115f82a148cdf87a9617b9