PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45878 Linux CVE debrief

A bounds-checking flaw in the Linux kernel's AMD GPU driver (drm/amdkfd) could allow local attackers to trigger memory corruption or undefined behavior. The vulnerability exists in the debug address watch functionality where a user-supplied watch_id value, received as unsigned 32-bit integer, was processed through signed integer operations without proper validation. When a watch_id exceeding INT_MAX (2,147,483,648) is provided, it becomes negative during signed conversion, causing invalid bit-shift operations and potential out-of-bounds access to the watch_points array. The fix adds explicit bounds checking against MAX_WATCH_ADDRESSES before using watch_id, and replaces manual bit manipulation with BIT() macro for safe operations. This affects systems with AMD GPUs using the AMDGPU kernel driver with KFD (Kernel Fusion Driver) debugging features enabled.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators running AMD GPU systems with KFD debugging enabled; security teams monitoring kernel driver vulnerabilities; organizations using AMD GPUs for compute workloads with ROCm/KFD stack

Technical summary

The vulnerability resides in drivers/gpu/drm/amd/amdkfd/kfd_debug.c in the kfd_dbg_trap_clear_dev_address_watch() function. The watch_id parameter is received as uint32_t but passed to helper functions using signed int, enabling integer conversion to negative values when watch_id > INT_MAX. This causes undefined behavior in bit-shift operations and potential out-of-bounds array access to pdd->watch_points[]. The fix validates watch_id < MAX_WATCH_ADDRESSES early in both set and clear code paths, and uses BIT(watch_id) for safe bit manipulation. Multiple stable kernel branches received backported fixes.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the drm/amdkfd fix for CVE-2026-45878 when available from your Linux distribution
  • Verify kernel version includes commits addressing this vulnerability in the stable kernel branches
  • Restrict access to KFD debugging interfaces to trusted administrative users only
  • Monitor for unexpected system crashes or GPU driver errors that could indicate exploitation attempts
  • Review system logs for anomalous debug address watch operations from untrusted processes

Evidence notes

The vulnerability description and patch details are sourced from the official CVE record and NVD entry published 2026-05-27. The fix involves multiple stable kernel commits referenced in the source data. The issue was identified through static analysis detecting potential buffer overflow with user-controlled watch_id values in the range 0-3 and 2147483648-u32max.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45878 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45878

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45878 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45878

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.