CVE-2026-68258 - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

Back Back to CVE browser

HIGH

drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

Published Aug 10, 2026

7.1

HIGH

CVSS 3.1

EPSS 0.16%

Description

We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds.

For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided type is less than it.

For mqd_size, add new function mqd_size_from_queue_type and confirm that the provided mqd_size matches expectations.

(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.18
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.18
- Version
  6.18.42
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  7.1.6
  Status
  unaffected
  Constraints
  <=7.1.*
- Version
  7.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.18	affected	-
0	unaffected	<5.18
6.18.42	unaffected	<=6.18.*
7.1.6	unaffected	<=7.1.*
7.2	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Fix deferred
Red Hat Enterprise Linux 6

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel

Fix deferred
Red Hat Enterprise Linux 7

kernel-rt

Will not fix
Red Hat Enterprise Linux 8

kernel

Fix deferred
Red Hat Enterprise Linux 8

kernel-rt

Will not fix
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred
Red Hat Enterprise Linux for NVIDIA 26

kernel

Out of support scope
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-8

Not affected
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-9

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 6	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 7	kernel-rt	Will not fix	n/a
Red Hat Enterprise Linux 8	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel-rt	Will not fix	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux for NVIDIA 26	kernel	Out of support scope	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-9	Fix deferred	n/a

Remediation

Red Hat statement

This issue affects AMDGPU KFD CRIU restore. Queue type and MQD size from restore blobs are not bounds-checked. Requires KFD compute and CRIU restore capability.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (9)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-68258		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2513325		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55359		Advisory
https://git.kernel.org/stable/c/47ea05f246bebc81c7796f56265cffd812cf0601
https://git.kernel.org/stable/c/cc10a5839756982504ee8568fc1e1625962ab7f8
https://git.kernel.org/stable/c/fd1691ec62701c982ea32e749678988c67fd4c21
https://lore.kernel.org/linux-cve-announce/2026081021-CVE-2026-68258-6be3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68258
https://www.cve.org/CVERecord?id=CVE-2026-68258