All vulnerabilities
CVE-2026-97495

Linux: drm/amdkfd: Check bounds on allocate_doorbell

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7e06636260a2d95e3fa181bc337d0eeb812b7a41Also 3d2ddfc9b361b0d38c3ff4804ce42503e4bc97de, 1f087bb8cf9e8797633da35c85435e557ef74d06CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 7e06636260a2d95e3fa181bc337d0eeb812b7a41LinuxCVE List
  • 3d2ddfc9b361b0d38c3ff4804ce42503e4bc97deLinuxCVE List
  • 1f087bb8cf9e8797633da35c85435e557ef74d06LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check bounds on allocate_doorbell

allocated_doorbell has an option to set the doorbell id to a specific value (used by CRIU). This value was not bounds checked.

Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.

Text from CVE List

Affected versions 12

  • Linuxaffected: 5bb6a8fa75fcfda93592bee0a4910420ceab15f3 before 7e06636260a2d95e3fa181bc337d0eeb812b7a41CVE List
  • Linuxaffected: 5bb6a8fa75fcfda93592bee0a4910420ceab15f3 before 3d2ddfc9b361b0d38c3ff4804ce42503e4bc97deCVE List
  • Linuxaffected: 5bb6a8fa75fcfda93592bee0a4910420ceab15f3 before e0cecd04a4fc4c75e375b91cf53eab5ba2e4ab7fCVE List
  • Linuxaffected: 5bb6a8fa75fcfda93592bee0a4910420ceab15f3 before c2c89118c27cbd3adace62c5df19d15b0e96ade1CVE List
  • Linuxaffected: 5bb6a8fa75fcfda93592bee0a4910420ceab15f3 before 1f087bb8cf9e8797633da35c85435e557ef74d06CVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 5