GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel amdkfd: unbounded copy_to_user in get_wave_state leaks adjacent kernel memory

CVSS 7.1CVE-2026-97496NVIDIA / GPU stackcurated

Impact

get_wave_state() for v9 trusts the control-stack size and offset read from the MQD. Those fields are attacker-controlled on the CRIU restore path via AMDKFD_IOC_RESTORE_PROCESS, and an offset larger than the size underflows into a roughly 4 GiB read length; a 1 MiB size against a 4 KiB allocation leaks 1 MiB of adjacent kernel memory. What leaks is exactly the sensitive neighbourhood on an AMD GPU node: other queues' MQDs, ring buffers, and KASLR pointers. On a shared AMD fleet this is a local tenant reading kernel memory that belongs to other GPU workloads, and it is a plausible first step toward defeating KASLR for a further exploit.

Who can reach it

Local user holding /dev/kfd - any tenant with an AMD GPU pod or shell on the node. No special privilege beyond device access, and the CRIU restore ioctl is reachable from an ordinary process.

What to do

Apply the stable kernel fix (commits 7ef1444, d9183d9, ec64668) that clamps both the control-stack size and offset to the allocated buffer, then reboot each AMD GPU node - drain and reboot, since a live kernel patch is not offered here. If you cannot reboot soon, the exposure is confined to processes holding /dev/kfd, so restricting which workloads get the device is a real mitigation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-97496https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5https://git.kernel.org/stable/c/d9183d974ddd5f09d029beaf359275ac20d4d5fehttps://git.kernel.org/stable/c/ec646686613d8ab05b282d1463a7baa49fd6b83b

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.