CVE-2026-74357

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

The ring content dump in amdgpu_coredump() uses two separate loops over adev->rings[]: the first counts rings with unsignalled fences to size the allocation, and the second copies ring data into the allocated buffers.

Both loops use the same condition to skip rings:

Because last_seq is an atomic that is updated concurrently by the fence signalling path, additional rings may appear unsignalled in the second loop that were signalled during the first. When this happens, idx exceeds the allocated ring_count and the store to coredump->rings[idx] writes past the end of the kcalloc-ed buffer.

Leer descripción completaMostrar menos

This was found during IGT stressful test amd_queue_reset which triggers random GPU resets. The OVERSIZE subtest (CMD_STREAM_EXEC_INVALID_PACKET_LENGTH_OVERSIZE on GFX ring) provokes a ring timeout and subsequent coredump, which hits the race between the counting and copying loops. The failure is non-deterministic and depends on fence signalling timing during the reset.

72 bytes = 3 * sizeof(struct amdgpu_coredump_ring), so ring_count was 3 but idx reached 3+, writing ring_index (at struct offset 16) 16 bytes past the allocation.

Fix by adding an idx < ring_count guard to the copy loop so it cannot exceed the allocated count even when the fence state changes between the two passes.

Detalles técnicos trazas, registros y código del informe original

    atomic_read(&ring->fence_drv.last_seq) == ring->fence_drv.sync_seq

KASAN log:

  BUG: KASAN: slab-out-of-bounds in amdgpu_coredump+0x1274/0x12f0 [amdgpu]
  Write of size 4 at addr ffff888106154258 by task kworker/u128:5/23625
  CPU: 16 UID: 0 PID: 23625 Comm: kworker/u128:5 Not tainted 6.19.0+ #35
  Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]
  Call Trace:
   <TASK>
   dump_stack_lvl+0xa5/0x110
   print_report+0xd1/0x660
   kasan_report+0xf3/0x130
   __asan_report_store4_noabort+0x17/0x30
   amdgpu_coredump+0x1274/0x12f0 [amdgpu]
   amdgpu_job_timedout+0xef0/0x16c0 [amdgpu]
   drm_sched_job_timedout+0x194/0x5c0 [gpu_sched]
   process_one_work+0x84b/0x1990
   worker_thread+0x6b8/0x11b0
   </TASK>

  Allocated by task 23625:
   kasan_save_stack+0x39/0x70
   __kasan_kmalloc+0xc3/0xd0
   __kmalloc_noprof+0x2ec/0x910
   amdgpu_coredump+0x5c5/0x12f0 [amdgpu]
   amdgpu_job_timedout+0xef0/0x16c0 [amdgpu]

  The buggy address belongs to the object at ffff888106154200
   which belongs to the cache kmalloc-rnd-09-96 of size 96
  The buggy address is located 16 bytes to the right of
   allocated 72-byte region [ffff888106154200, ffff888106154248)

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.17%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation60 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-74357",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "eea85914d15bfe3bdf9f8f80a479f0dee0aa7d73",
              "lessThan": "efb1dadaeb897b22b9e118d398d0f41e70e9ccca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eea85914d15bfe3bdf9f8f80a479f0dee0aa7d73",
              "lessThan": "08ac3a7879d300302a1927ce2038629539a37f8b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:37.170",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/08ac3a7879d300302a1927ce2038629539a37f8b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/efb1dadaeb897b22b9e118d398d0f41e70e9ccca",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump\n\nThe ring content dump in amdgpu_coredump() uses two separate loops over\nadev->rings[]: the first counts rings with unsignalled fences to size\nthe allocation, and the second copies ring data into the allocated\nbuffers.\n\nBoth loops use the same condition to skip rings:\n\n    atomic_read(&ring->fence_drv.last_seq) == ring->fence_drv.sync_seq\n\nBecause last_seq is an atomic that is updated concurrently by the fence\nsignalling path, additional rings may appear unsignalled in the second\nloop that were signalled during the first. When this happens, idx\nexceeds the allocated ring_count and the store to coredump->rings[idx]\nwrites past the end of the kcalloc-ed buffer.\n\nThis was found during IGT stressful test amd_queue_reset which\ntriggers random GPU resets. The OVERSIZE subtest\n(CMD_STREAM_EXEC_INVALID_PACKET_LENGTH_OVERSIZE on GFX ring) provokes\na ring timeout and subsequent coredump, which hits the race between\nthe counting and copying loops. The failure is non-deterministic and\ndepends on fence signalling timing during the reset.\n\nKASAN log:\n\n  BUG: KASAN: slab-out-of-bounds in amdgpu_coredump+0x1274/0x12f0 [amdgpu]\n  Write of size 4 at addr ffff888106154258 by task kworker/u128:5/23625\n  CPU: 16 UID: 0 PID: 23625 Comm: kworker/u128:5 Not tainted 6.19.0+ #35\n  Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xa5/0x110\n   print_report+0xd1/0x660\n   kasan_report+0xf3/0x130\n   __asan_report_store4_noabort+0x17/0x30\n   amdgpu_coredump+0x1274/0x12f0 [amdgpu]\n   amdgpu_job_timedout+0xef0/0x16c0 [amdgpu]\n   drm_sched_job_timedout+0x194/0x5c0 [gpu_sched]\n   process_one_work+0x84b/0x1990\n   worker_thread+0x6b8/0x11b0\n   </TASK>\n\n  Allocated by task 23625:\n   kasan_save_stack+0x39/0x70\n   __kasan_kmalloc+0xc3/0xd0\n   __kmalloc_noprof+0x2ec/0x910\n   amdgpu_coredump+0x5c5/0x12f0 [amdgpu]\n   amdgpu_job_timedout+0xef0/0x16c0 [amdgpu]\n\n  The buggy address belongs to the object at ffff888106154200\n   which belongs to the cache kmalloc-rnd-09-96 of size 96\n  The buggy address is located 16 bytes to the right of\n   allocated 72-byte region [ffff888106154200, ffff888106154248)\n\n72 bytes = 3 * sizeof(struct amdgpu_coredump_ring), so ring_count was 3\nbut idx reached 3+, writing ring_index (at struct offset 16) 16 bytes\npast the allocation.\n\nFix by adding an idx < ring_count guard to the copy loop so it cannot\nexceed the allocated count even when the fence state changes between\nthe two passes."
    }
  ],
  "lastModified": "2026-08-17T06:19:30.407",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}