PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46197 Linux CVE debrief

A vulnerability in the Linux kernel's AMD GPU kernel driver (amdkfd) allowed out-of-bounds buffer access through the SVM (Shared Virtual Memory) ioctl interface. The flaw stemmed from insufficient validation of the `nattr` field, which specifies the number of attributes in a user-supplied buffer. Without proper bounds checking against the actual buffer size, a user-controlled attribute count could trigger memory access beyond allocated boundaries. The fix adds validation to ensure `nattr` does not exceed the buffer's capacity. This vulnerability affects systems using AMD GPUs with ROCm/HSA compute capabilities where the amdkfd driver is active. The issue was resolved in the Linux kernel stable branches, with patches backported to multiple kernel versions.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux systems with AMD GPUs, particularly those using ROCm/HSA compute workloads. Cloud providers and HPC environments with AMD GPU infrastructure. System administrators responsible for kernel security maintenance.

Technical summary

The vulnerability exists in the drm/amdkfd driver's SVM (Shared Virtual Memory) ioctl implementation. The `nattr` parameter, which indicates the number of attributes provided by userspace, was not validated against the actual size of the attribute buffer. This allowed a malicious or malformed userspace application to specify a `nattr` value larger than the allocated buffer, causing the kernel to read or write beyond buffer boundaries during attribute processing. The fix introduces proper bounds validation to ensure `nattr` does not exceed the buffer capacity before attribute iteration occurs.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the amdkfd SVM ioctl fix
  • Verify running kernel version against patched versions in stable kernel branches
  • For systems using AMD ROCm/HSA compute workloads, prioritize kernel updates
  • Monitor NVD for CVSS score assignment once analysis is complete

Evidence notes

CVE description confirms the vulnerability is in drm/amdkfd SVM ioctl handling. The fix validates nattr against buffer size to prevent out-of-bounds access. Five kernel.org stable branch commits are referenced, indicating backports to multiple kernel versions. No CVSS score or severity rating has been assigned by NVD (status: Awaiting Analysis).

Official resources

2026-05-28