CVE-2026-74447

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow occurs in the drm/amdkfd component when aligning the EOP ring buffer size. In the kfd queue acquire buffers() function, the eop ring buffer size variable within the queue properties structure is processed as a 32-bit unsigned integer. When a user provides a specific large size, such as 0xFFFFF001, the alignment calculation wraps to 0. This causes the kfd queue buffer get() function to bypass its size validation check, allowing the acceptance of an incorrectly sized Buffer Object (BO). On GFX8 and GFX9 hardware, this can lead to a situation where the cp hqd eop control is programmed for an 8KB EOP ring while only backed by a 4KB BO, resulting in writes that exceed the buffer boundary and cause a GPU fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.