Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-68257— drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.12.101之前版本、6.18.42之前版本和7.1.6之前版本存在安全漏洞，该漏洞源于CWSR总大小计算存在32位整数溢出，可能导致固件越界覆盖。

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 13

VendorProduct Version RangeStatus
Linux Linux 325aa07165394b8e866ffe9ec1d4c99d9195b2f2< b88ffe6593607364a8c06a48c6f29e55437cdf8e affected
d15deafab5d722afb9e2f83c5edcdef9d9d98bd1< abce3276c57e36c955627307469b9f009057a467 affected
d15deafab5d722afb9e2f83c5edcdef9d9d98bd1< 865532d54eb57b660b1cb1b0e1755776ce21b849 affected
d15deafab5d722afb9e2f83c5edcdef9d9d98bd1< 2b0386d4293920e690c0e017708f999b93cc729b affected
63600103d2ac5c09fdeec5b931b396e4e0efd5d8 affected
6.12.59< 6.12.101 affected
6.17.9< 6.18 affected
6.18 affected
… +5 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68257

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and debug_memory_size multiplied by the XCC count, the product can wrap, yielding an undersized CWSR save area that firmware later overruns. Promote total_cwsr_size to u64 and use check_add_overflow()/ check_mul_overflow() in both kfd_queue_acquire_buffers() and kfd_queue_release_buffers(). (cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.12.101之前版本、6.18.42之前版本和7.1.6之前版本存在安全漏洞，该漏洞源于CWSR总大小计算存在32位整数溢出，可能导致固件越界覆盖。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 325aa07165394b8e866ffe9ec1d4c99d9195b2f2 ~ b88ffe6593607364a8c06a48c6f29e55437cdf8e -
Linux Linux 6.18 -

II. Public POCs for CVE-2026-68257

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68257

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68257 (4)

Same Patch Batch · Linux · 2026-08-10 · 344 CVEs total

CVE-2026-68170 9.8 CRITICAL mptcp: fix stale skb->sk reference on subflow close
CVE-2026-68117 9.8 CRITICAL tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
CVE-2026-68385 9.8 CRITICAL s390/checksum: Fix csum_partial() without vector facility
CVE-2026-68161 9.8 CRITICAL sctp: close UDP tunnel sockets during netns teardown
CVE-2026-68300 9.8 CRITICAL sctp: auth: verify auth requirement when auth_chunk is NULL
CVE-2026-68160 9.8 CRITICAL ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
CVE-2026-68388 9.8 CRITICAL smb/client: handle overlapping allocated ranges in fallocate
CVE-2026-68123 9.8 CRITICAL openvswitch: fix GSO userspace truncation underflow
CVE-2026-68127 9.8 CRITICAL ila: reload IPv6 header after pskb_may_pull in checksum adjust
CVE-2026-68302 9.8 CRITICAL amt: re-read skb header pointers after every pull
CVE-2026-68159 9.8 CRITICAL libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
CVE-2026-68158 9.8 CRITICAL libceph: Fix multiplication overflow in decode_new_up_state_weight()
CVE-2026-68156 9.8 CRITICAL libceph: refresh auth->authorizer_buf{,_len} after authorizer update
CVE-2026-68381 9.8 CRITICAL ksmbd: pin conn during async oplock break notification
CVE-2026-68426 9.8 CRITICAL xfrm: fix stale skb->prev after async crypto steals a GSO segment
CVE-2026-68154 9.8 CRITICAL libceph: reject zero bucket types in crush_decode
CVE-2026-68144 9.8 CRITICAL phonet: pep: fix use-after-free in pep_get_sb()
CVE-2026-68137 9.8 CRITICAL net/x25: fix use-after-free in x25_kill_by_neigh()
CVE-2026-68136 9.8 CRITICAL net: gro: fix double aggregation of flush-marked skbs
CVE-2026-68124 9.6 CRITICAL mctp: serial: handle zero-length frames to prevent rx buffer overflow

Showing top 20 of 344 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68257

No comments yet

Leave a comment