CVE-2026-74357

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds write occurs in the amdgpu coredump() function during the ring content dump process. The function utilizes two separate loops over adev->rings[]: the first to count rings with unsignalled fences to determine the allocation size, and the second to copy ring data into the allocated buffers. Both loops rely on the condition atomic read(&ring->fence drv.last seq) == ring->fence drv.sync seq to skip rings.

Because last seq is an atomic variable updated concurrently by the fence signalling path, a race condition exists where additional rings may appear unsignalled during the second loop that were signalled during the first. This causes the index idx to exceed the allocated ring count, resulting in a write past the end of the buffer allocated via kcalloc when storing to coredump->rings[idx].

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.