PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46229 Linux CVE debrief

A vulnerability in the Linux kernel's AMDGPU KFD (Kernel Fusion Driver) subsystem allows stale VRAM data to persist across allocations, potentially exposing sensitive information from prior GPU computations and causing stability issues in ROCm/RCCL workloads. The KFD VRAM allocation path failed to set the AMDGPU_GEM_CREATE_VRAM_CLEARED flag, which is already present in the standard GEM ioctl and dumb buffer creation paths. This omission leaves freshly allocated GPU memory containing residual data from previous allocations, including potential page table remnants. The issue manifests as crashes in RCCL (ROCm Communication Collectives Library) peer-to-peer transport, where non-zero data in protocol handshake fields (ptrExchange, head, tail) corrupts the communication protocol. The vulnerability was resolved by adding the VRAM_CLEARED flag to KFD allocations, ensuring memory is zeroed before being handed to compute kernels.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running ROCm/AMD GPU compute workloads, multi-tenant GPU cloud providers, HPC environments using RCCL for inter-GPU communication, and Linux distributions shipping AMDGPU kernel drivers

Technical summary

The drm/amdkfd driver in the Linux kernel allocates VRAM for compute workloads without clearing memory contents, unlike the standard GEM ioctl path. KFD allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but omit AMDGPU_GEM_CREATE_VRAM_CLEARED, allowing stale data from previous GPU operations to persist in newly allocated buffers. This can expose page table remnants or other sensitive data to subsequent compute kernels and causes protocol corruption in RCCL P2P transport where handshake fields contain unexpected non-zero values. The fix adds the missing VRAM_CLEARED flag to KFD allocation paths, ensuring memory is zeroed before use.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the drm/amdkfd VRAM clearing fix for affected stable branches
  • Monitor ROCm/RCCL workloads for ptrExchange/head/tail field corruption errors as indicators of this issue
  • Verify AMDGPU_GEM_CREATE_VRAM_CLEARED is present in KFD allocation paths when auditing custom kernel builds
  • Review GPU compute environments for potential information disclosure from uncleared VRAM between tenant workloads
  • Consider enabling additional memory clearing policies in ROCm deployments until patches are deployed

Evidence notes

The CVE description and kernel commit references confirm the vulnerability exists in the drm/amdkfd driver. The fix involves adding AMDGPU_GEM_CREATE_VRAM_CLEARED to KFD VRAM allocation flags, matching the behavior already implemented in amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). Multiple stable kernel branch commits are referenced, indicating backports to supported releases.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46229 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46229

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46229 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46229

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/047d44d8d29a6a1a5757256837aa9dd78e3cd0b5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1db431380879fd9d28b763a88a0c0431be5be8df

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/32b153658f017ad2f5bf8aab479e8d16ac95bc3a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/77d0b5d11387071770246fd0185a69fa28e8e109

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ad52d61d82181dbdb7f05826de38352d5e550cc2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.