All vulnerabilities
CVE-2026-97497

Linux: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in41460d2dd0246f0ab7e80b103d34c8649e022999Also 25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3, 42f2bd50236b61ad0aeb2c233c990ee0d615fdadCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 41460d2dd0246f0ab7e80b103d34c8649e022999LinuxCVE List
  • 25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3LinuxCVE List
  • 42f2bd50236b61ad0aeb2c233c990ee0d615fdadLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value.

Confirm it's less than the maximum number of queues.

Text from CVE List

Affected versions 12

  • Linuxaffected: 2485c12c980a36bb9e23ababb07d73c4ac6a45af before 41460d2dd0246f0ab7e80b103d34c8649e022999CVE List
  • Linuxaffected: 2485c12c980a36bb9e23ababb07d73c4ac6a45af before 25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3CVE List
  • Linuxaffected: 2485c12c980a36bb9e23ababb07d73c4ac6a45af before 42f2bd50236b61ad0aeb2c233c990ee0d615fdadCVE List
  • Linuxaffected: 2485c12c980a36bb9e23ababb07d73c4ac6a45af before dd2870ca036e1d51baa59f942007b36a595b5890CVE List
  • Linuxaffected: 2485c12c980a36bb9e23ababb07d73c4ac6a45af before bfe9a7545b2a7be1c543f1741e16f2d5ec4116aeCVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 5