Vulnerability-Lookup

CVE-2026-45878 (GCVE-0-2026-45878)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:16 – Updated: 2026-08-05 12:28

Title

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id. If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array. drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely. This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, 434 uint32_t watch_id) 435 { 436 int r; 437 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id)) kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined). 439 return -EINVAL; 440 441 if (!pdd->dev->kfd->shared_resources.enable_mes) { 442 r = debug_lock_and_unmap(pdd->dev->dqm); 443 if (r) 444 return r; 445 } 446 447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false); --> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch( 449 pdd->dev->adev, 450 watch_id); v2: (as per, Jonathan Kim) - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path. - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/971bf8e61e9b4abaa…
https://git.kernel.org/stable/c/a0d367e13db63a6ed…
https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6…
https://git.kernel.org/stable/c/3c38a0f07aa2bfef2…
https://git.kernel.org/stable/c/5a19302cab5cec7ae…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 971bf8e61e9b4abaacf9b35eaf76ec222758f9d6 (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488 (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 2b36c0c1bcbbe15f6cfa9652084b3124c835a150 (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 3c38a0f07aa2bfef2b219b1f045534ad93f85afd (git) Affected: e0f85f4690d089cc1a60337decafb1acf7eec45e , < 5a19302cab5cec7ae7f1a60c619951e6c17d8742 (git)	guessed
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "971bf8e61e9b4abaacf9b35eaf76ec222758f9d6",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "2b36c0c1bcbbe15f6cfa9652084b3124c835a150",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "3c38a0f07aa2bfef2b219b1f045534ad93f85afd",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "5a19302cab5cec7ae7f1a60c619951e6c17d8742",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nThe address watch clear code receives watch_id as an unsigned value\n(u32), but some helper functions were using a signed int and checked\nbits by shifting with watch_id.\n\nIf a very large watch_id is passed from userspace, it can be converted\nto a negative value.  This can cause invalid shifts and may access\nmemory outside the watch_points array.\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nFix this by checking that watch_id is within MAX_WATCH_ADDRESSES before\nusing it.  Also use BIT(watch_id) to test and clear bits safely.\n\nThis keeps the behavior unchanged for valid watch IDs and avoids\nundefined behavior for invalid ones.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448\nkfd_dbg_trap_clear_dev_address_watch() error: buffer overflow\n\u0027pdd-\u003ewatch_points\u0027 4 \u003c= u32max user_rl=\u00270-3,2147483648-u32max\u0027 uncapped\n\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c\n    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,\n    434                                         uint32_t watch_id)\n    435 {\n    436         int r;\n    437\n    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))\n\nkfd_dbg_owns_dev_watch_id() doesn\u0027t check for negative values so if\nwatch_id is larger than INT_MAX it leads to a buffer overflow.\n(Negative shifts are undefined).\n\n    439                 return -EINVAL;\n    440\n    441         if (!pdd-\u003edev-\u003ekfd-\u003eshared_resources.enable_mes) {\n    442                 r = debug_lock_and_unmap(pdd-\u003edev-\u003edqm);\n    443                 if (r)\n    444                         return r;\n    445         }\n    446\n    447         amdgpu_gfx_off_ctrl(pdd-\u003edev-\u003eadev, false);\n--\u003e 448         pdd-\u003ewatch_points[watch_id] = pdd-\u003edev-\u003ekfd2kgd-\u003eclear_address_watch(\n    449                                                         pdd-\u003edev-\u003eadev,\n    450                                                         watch_id);\n\nv2: (as per, Jonathan Kim)\n - Add early watch_id \u003e= MAX_WATCH_ADDRESSES validation in the set path to\n   match the clear path.\n - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through an ioctl (AMDKFD_IOC_DBG_TRAP) on the local /dev/kfd device node; there is no network or remote path.\nAC:L - The attacker fully controls both the allocation of a watch point and the crafted watch_id; the negative-shift behavior is deterministic on x86, so the out-of-bounds write is triggered reliably and repeatably.\nPR:L - The ioctl has flags=0 with no capability check, and self-debugging (target==p) is permitted, so any unprivileged local user with access to the GPU device node (/dev/kfd) can reach the bug; no root/CAP_SYS_ADMIN is required.\nUI:N - The attacking process performs the enable/allocate/clear sequence entirely on its own; no action by another user is needed.\nS:U - The out-of-bounds write corrupts kernel memory within the same kernel security authority; it does not cross into a separate authority such as a hypervisor or IOMMU boundary.\nC:H - The bug is a kernel out-of-bounds write (memory corruption) that can be groomed to overwrite adjacent kernel structures (e.g., size/pointer fields), which can be leveraged to enable information disclosure.\nI:H - Attacker-influenced out-of-bounds write of a 32-bit value into kernel memory at a controllable offset is a direct kernel memory-corruption/write primitive.\nA:H - The out-of-bounds write into unmapped or critical kernel memory readily causes a kernel oops/panic, producing a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:38.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742"
        }
      ],
      "title": "drm/amdkfd: Fix watch_id bounds checking in debug address watch v2",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45878",
    "datePublished": "2026-05-27T12:16:49.108Z",
    "dateReserved": "2026-05-13T15:03:33.081Z",
    "dateUpdated": "2026-08-05T12:28:38.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45878",
      "date": "2026-09-15",
      "epss": "0.00182",
      "percentile": "0.07998"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45878\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:01.547\",\"lastModified\":\"2026-06-25T21:12:02.230\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\\n\\nThe address watch clear code receives watch_id as an unsigned value\\n(u32), but some helper functions were using a signed int and checked\\nbits by shifting with watch_id.\\n\\nIf a very large watch_id is passed from userspace, it can be converted\\nto a negative value.  This can cause invalid shifts and may access\\nmemory outside the watch_points array.\\n\\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\\n\\nFix this by checking that watch_id is within MAX_WATCH_ADDRESSES before\\nusing it.  Also use BIT(watch_id) to test and clear bits safely.\\n\\nThis keeps the behavior unchanged for valid watch IDs and avoids\\nundefined behavior for invalid ones.\\n\\nFixes the below:\\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448\\nkfd_dbg_trap_clear_dev_address_watch() error: buffer overflow\\n\u0027pdd-\u003ewatch_points\u0027 4 \u003c= u32max user_rl=\u00270-3,2147483648-u32max\u0027 uncapped\\n\\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c\\n    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,\\n    434                                         uint32_t watch_id)\\n    435 {\\n    436         int r;\\n    437\\n    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))\\n\\nkfd_dbg_owns_dev_watch_id() doesn\u0027t check for negative values so if\\nwatch_id is larger than INT_MAX it leads to a buffer overflow.\\n(Negative shifts are undefined).\\n\\n    439                 return -EINVAL;\\n    440\\n    441         if (!pdd-\u003edev-\u003ekfd-\u003eshared_resources.enable_mes) {\\n    442                 r = debug_lock_and_unmap(pdd-\u003edev-\u003edqm);\\n    443                 if (r)\\n    444                         return r;\\n    445         }\\n    446\\n    447         amdgpu_gfx_off_ctrl(pdd-\u003edev-\u003eadev, false);\\n--\u003e 448         pdd-\u003ewatch_points[watch_id] = pdd-\u003edev-\u003ekfd2kgd-\u003eclear_address_watch(\\n    449                                                         pdd-\u003edev-\u003eadev,\\n    450                                                         watch_id);\\n\\nv2: (as per, Jonathan Kim)\\n - Add early watch_id \u003e= MAX_WATCH_ADDRESSES validation in the set path to\\n   match the clear path.\\n - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_debug.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\"lessThan\":\"971bf8e61e9b4abaacf9b35eaf76ec222758f9d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\"lessThan\":\"a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\"lessThan\":\"2b36c0c1bcbbe15f6cfa9652084b3124c835a150\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\"lessThan\":\"3c38a0f07aa2bfef2b219b1f045534ad93f85afd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\"lessThan\":\"5a19302cab5cec7ae7f1a60c619951e6c17d8742\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_debug.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"A502C6C1-0CFB-4C9B-8A24-C76507206FA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"BF463CB7-1F58-4607-B847-77ED23E4B9B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T07:58:34+00:00",
      "cve": "CVE-2026-45878",
      "id": "CVE-2026-45878",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "76",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45878.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T16:59:56Z",
      "cve": "CVE-2026-45878",
      "id": "CVE-2026-45878",
      "initial_release_date": "2026-05-28T03:57:00Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "302",
      "product_status:recommended": "366",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45878",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45878.json",
      "version": "13"
    }
  }
}

FKIE_CVE-2026-45878

Vulnerability from fkie_nvd - Published: 2026-05-27 14:17 - Updated: 2026-06-25 21:12

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "971bf8e61e9b4abaacf9b35eaf76ec222758f9d6",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "2b36c0c1bcbbe15f6cfa9652084b3124c835a150",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "3c38a0f07aa2bfef2b219b1f045534ad93f85afd",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            },
            {
              "lessThan": "5a19302cab5cec7ae7f1a60c619951e6c17d8742",
              "status": "affected",
              "version": "e0f85f4690d089cc1a60337decafb1acf7eec45e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A502C6C1-0CFB-4C9B-8A24-C76507206FA7",
              "versionEndExcluding": "6.6.128",
              "versionStartIncluding": "6.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
              "versionEndExcluding": "6.12.75",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF463CB7-1F58-4607-B847-77ED23E4B9B7",
              "versionEndExcluding": "6.18.14",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092",
              "versionEndExcluding": "6.19.4",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nThe address watch clear code receives watch_id as an unsigned value\n(u32), but some helper functions were using a signed int and checked\nbits by shifting with watch_id.\n\nIf a very large watch_id is passed from userspace, it can be converted\nto a negative value.  This can cause invalid shifts and may access\nmemory outside the watch_points array.\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nFix this by checking that watch_id is within MAX_WATCH_ADDRESSES before\nusing it.  Also use BIT(watch_id) to test and clear bits safely.\n\nThis keeps the behavior unchanged for valid watch IDs and avoids\nundefined behavior for invalid ones.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448\nkfd_dbg_trap_clear_dev_address_watch() error: buffer overflow\n\u0027pdd-\u003ewatch_points\u0027 4 \u003c= u32max user_rl=\u00270-3,2147483648-u32max\u0027 uncapped\n\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c\n    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,\n    434                                         uint32_t watch_id)\n    435 {\n    436         int r;\n    437\n    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))\n\nkfd_dbg_owns_dev_watch_id() doesn\u0027t check for negative values so if\nwatch_id is larger than INT_MAX it leads to a buffer overflow.\n(Negative shifts are undefined).\n\n    439                 return -EINVAL;\n    440\n    441         if (!pdd-\u003edev-\u003ekfd-\u003eshared_resources.enable_mes) {\n    442                 r = debug_lock_and_unmap(pdd-\u003edev-\u003edqm);\n    443                 if (r)\n    444                         return r;\n    445         }\n    446\n    447         amdgpu_gfx_off_ctrl(pdd-\u003edev-\u003eadev, false);\n--\u003e 448         pdd-\u003ewatch_points[watch_id] = pdd-\u003edev-\u003ekfd2kgd-\u003eclear_address_watch(\n    449                                                         pdd-\u003edev-\u003eadev,\n    450                                                         watch_id);\n\nv2: (as per, Jonathan Kim)\n - Add early watch_id \u003e= MAX_WATCH_ADDRESSES validation in the set path to\n   match the clear path.\n - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id()."
    }
  ],
  "id": "CVE-2026-45878",
  "lastModified": "2026-06-25T21:12:02.230",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-27T14:17:01.547",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4753-MHW2-5G7R

Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-05-30 12:30

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id.

If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array.

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely.

This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones.

Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped

drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, 434 uint32_t watch_id) 435 { 436 int r; 437 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))

kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined).

439                 return -EINVAL;
440
441         if (!pdd->dev->kfd->shared_resources.enable_mes) {
442                 r = debug_lock_and_unmap(pdd->dev->dqm);
443                 if (r)
444                         return r;
445         }
446
447         amdgpu_gfx_off_ctrl(pdd->dev->adev, false);

--> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch( 449 pdd->dev->adev, 450 watch_id);

v2: (as per, Jonathan Kim) - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path. - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-45878"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T14:17:01Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nThe address watch clear code receives watch_id as an unsigned value\n(u32), but some helper functions were using a signed int and checked\nbits by shifting with watch_id.\n\nIf a very large watch_id is passed from userspace, it can be converted\nto a negative value.  This can cause invalid shifts and may access\nmemory outside the watch_points array.\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nFix this by checking that watch_id is within MAX_WATCH_ADDRESSES before\nusing it.  Also use BIT(watch_id) to test and clear bits safely.\n\nThis keeps the behavior unchanged for valid watch IDs and avoids\nundefined behavior for invalid ones.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448\nkfd_dbg_trap_clear_dev_address_watch() error: buffer overflow\n\u0027pdd-\u003ewatch_points\u0027 4 \u003c= u32max user_rl=\u00270-3,2147483648-u32max\u0027 uncapped\n\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c\n    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,\n    434                                         uint32_t watch_id)\n    435 {\n    436         int r;\n    437\n    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))\n\nkfd_dbg_owns_dev_watch_id() doesn\u0027t check for negative values so if\nwatch_id is larger than INT_MAX it leads to a buffer overflow.\n(Negative shifts are undefined).\n\n    439                 return -EINVAL;\n    440\n    441         if (!pdd-\u003edev-\u003ekfd-\u003eshared_resources.enable_mes) {\n    442                 r = debug_lock_and_unmap(pdd-\u003edev-\u003edqm);\n    443                 if (r)\n    444                         return r;\n    445         }\n    446\n    447         amdgpu_gfx_off_ctrl(pdd-\u003edev-\u003eadev, false);\n--\u003e 448         pdd-\u003ewatch_points[watch_id] = pdd-\u003edev-\u003ekfd2kgd-\u003eclear_address_watch(\n    449                                                         pdd-\u003edev-\u003eadev,\n    450                                                         watch_id);\n\nv2: (as per, Jonathan Kim)\n - Add early watch_id \u003e= MAX_WATCH_ADDRESSES validation in the set path to\n   match the clear path.\n - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().",
  "id": "GHSA-4753-mhw2-5g7r",
  "modified": "2026-05-30T12:30:23Z",
  "published": "2026-05-27T15:33:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45878"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:21555-1

Vulnerability from csaf_opensuse - Published: 2026-08-12 01:09 - Updated: 2026-09-15 16:13

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-45878.

CVE-2026-45878

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Recommended: 136 products

Open the full advisory

RHSA-2026:57251

Vulnerability from csaf_redhat - Published: 2026-08-20 06:35 - Updated: 2026-09-16 01:08

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2026-45878.

CVE-2026-45878

A flaw was found in the Linux kernel's AMD KFD (Kernel Fusion Driver) component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watch_id. This could lead to a buffer overflow, potentially allowing memory access outside of intended bounds and causing system instability or denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 309 products

https://access.redhat.com/errata/RHSA-2026:57251

Open the full advisory

RHSA-2026:57252

Vulnerability from csaf_redhat - Published: 2026-08-20 06:44 - Updated: 2026-09-09 22:37

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2026-45878.

CVE-2026-45878

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 303 products

https://access.redhat.com/errata/RHSA-2026:57252

Open the full advisory

rlsa-2026:57251

Vulnerability from osv_rocky

Published

2026-08-21 12:07

Modified

2026-09-04 12:13

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

Bug Fix(es) and Enhancement(s):

CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:Rocky Linux-223954)
vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)
cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)
cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky Linux-235812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:57251	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2482124	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495950	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502422	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467202	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482113	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467156	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492719	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2506790	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513470	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482558	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502443	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502188	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492403	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502321	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2508504	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507042	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507216	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492768	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495941	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502449	REPORT
	https://access.redhat.com/errata/RHSA-2026:57251	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-10-riscv64\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:57251"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)\n\n* kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)\n\n* kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)\n\n* kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)\n\n* kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)\n\n* kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)\n\n* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)\n\n* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)\n\n* kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)\n\n* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)\n\n* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)\n\n* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)\n\n* kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)\n\n* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)\n\n* kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)\n\n* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)\n\n* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)\n\n* kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)\n\n* kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)\n\n* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)\n\n* kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)\n\n* kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)\n\nBug Fix(es) and Enhancement(s):\n\n* CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:Rocky Linux-223954)\n\n* vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)\n\n* cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)\n\n* cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky Linux-235812)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:57251",
  "modified": "2026-09-04T12:13:19.866601Z",
  "published": "2026-08-21T12:07:48.154734Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:57251"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482124"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495950"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502422"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467202"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482113"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467156"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492719"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513470"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482558"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502443"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502188"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508504"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507042"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507216"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492768"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495941"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502449"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:57251"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43206",
    "CVE-2026-43237",
    "CVE-2026-43493",
    "CVE-2026-45878",
    "CVE-2026-45991",
    "CVE-2026-46185",
    "CVE-2026-52991",
    "CVE-2026-53136",
    "CVE-2026-53143",
    "CVE-2026-53329",
    "CVE-2026-53356",
    "CVE-2026-53374",
    "CVE-2026-63879",
    "CVE-2026-63884",
    "CVE-2026-63886",
    "CVE-2026-63888",
    "CVE-2026-63952",
    "CVE-2026-64017",
    "CVE-2026-64219",
    "CVE-2026-64379",
    "CVE-2026-64382",
    "CVE-2026-64386",
    "CVE-2026-64560",
    "CVE-2026-68388"
  ]
}

rlsa-2026:57252

Vulnerability from osv_rocky

Published

2026-08-21 06:05

Modified

2026-09-04 06:12

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

Bug Fix(es) and Enhancement(s):

kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:Rocky Linux-181065)
vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:Rocky Linux-224549)
cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:Rocky Linux-235811)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:57252	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2467135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467156	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467202	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482113	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482124	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482614	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492403	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492719	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492768	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492788	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495941	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495950	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502188	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502321	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502361	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502422	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502443	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502589	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2506790	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507042	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507216	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2508504	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513373	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513470	REPORT
	https://access.redhat.com/errata/RHSA-2026:57252	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.41.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:57252"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n\n* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)\n\n* kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)\n\n* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)\n\n* kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)\n\n* kernel: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (CVE-2026-46120)\n\n* kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)\n\n* kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)\n\n* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)\n\n* kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)\n\n* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)\n\n* kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)\n\n* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)\n\n* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)\n\n* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)\n\n* kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)\n\n* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)\n\n* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)\n\n* kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)\n\n* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)\n\n* kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)\n\n* kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)\n\n* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)\n\n* kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)\n\n* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)\n\n* kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)\n\nBug Fix(es) and Enhancement(s):\n\n* kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS  (JIRA:Rocky Linux-181065)\n\n* vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:Rocky Linux-224549)\n\n* cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:Rocky Linux-235811)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:57252",
  "modified": "2026-09-04T06:12:41.194796Z",
  "published": "2026-08-21T06:05:24.924335Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:57252"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467156"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467202"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482113"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482124"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482614"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492719"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492768"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492788"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495941"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495950"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502188"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502361"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502422"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502443"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502589"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507042"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507216"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508504"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513470"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:57252"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43206",
    "CVE-2026-43233",
    "CVE-2026-43237",
    "CVE-2026-45878",
    "CVE-2026-45991",
    "CVE-2026-46120",
    "CVE-2026-52991",
    "CVE-2026-53136",
    "CVE-2026-53143",
    "CVE-2026-53189",
    "CVE-2026-53329",
    "CVE-2026-53356",
    "CVE-2026-53374",
    "CVE-2026-63879",
    "CVE-2026-63884",
    "CVE-2026-63888",
    "CVE-2026-63952",
    "CVE-2026-64007",
    "CVE-2026-64048",
    "CVE-2026-64219",
    "CVE-2026-64379",
    "CVE-2026-64382",
    "CVE-2026-64386",
    "CVE-2026-64560",
    "CVE-2026-68343",
    "CVE-2026-68388"
  ]
}

SUSE-SU-2026:22108-1

Vulnerability from csaf_suse - Published: 2026-06-15 18:32 - Updated: 2026-06-15 18:32

Summary

Security update for the Linux Kernel

Severity

Important

Scope

98 vulnerabilities in this advisory, including CVE-2026-45878.

CVE-2026-45878

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Recommended: 11 products

Open the full advisory

SUSE-SU-2026:22137-1

Vulnerability from csaf_suse - Published: 2026-06-15 17:11 - Updated: 2026-06-15 17:11

Summary

Security update for the Linux Kernel

Severity

Important

Scope

98 vulnerabilities in this advisory, including CVE-2026-45878.

CVE-2026-45878

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:22433-1

Vulnerability from csaf_suse - Published: 2026-06-30 17:41 - Updated: 2026-06-30 17:41

Summary

Security update for the Linux Kernel

Severity

Important

Scope

169 vulnerabilities in this advisory, including CVE-2026-45878.

CVE-2026-45878

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-45878 (GCVE-0-2026-45878)

Vulnerability from osv_rocky

Vulnerability from osv_rocky

Tags

Sightings

Nomenclature