HIGH Introduced in 3.19
amdkfd CRAT OOB
CVE-2026-80747
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
02KernelScan AI Analysis
Risk summary
A missing bounds check in the AMD KFD CRAT firmware-table parser allows out-of-bounds reads of kernel memory, which can lead to information disclosure or a kernel panic.
Vulnerability analysis
The AMD kernel fusion driver parses a platform firmware table that describes GPU and CPU topology. During initialization it reads subtype records from this table. The code checks that the subtype header itself lies within the table image, but it does not check that the full length advertised by the header stays inside the image. A table with a malformed, oversized length field causes the parser to read beyond the allocated buffer, leaking kernel memory or crashing the system. The fix adds a bounds check that rejects the subtype if its header plus its claimed length exceed the overall image size. Reaching the bug requires the ability to supply a tampered firmware table, which generally means privileged access to modify boot configuration or physical access to the platform firmware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 3.19 | 7.2 | 6e7566ba4739 |
| 7.1 | 3.19 | 7.1.10 | ca91e0cc8087 |