Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-03T13:06:14.303Z",
  "pubdate": "2026-09-03T13:06:14.303Z",
  "executiveSummary": "A critical out-of-bounds (OOB) read vulnerability exists within the Linux kernel's AMD KFD (Kernel Fusion Driver) component during the parsing of CRAT (Component Resource Affinity Table) structures.\nThe vulnerability stems from improper validation of the subtype length field provided within the CRAT header, allowing a malformed table to trigger memory access outside allocated bounds.\nImpacts include potential information disclosure and system instability. Exploitation requires the ability to provide or influence the CRAT table structure interpreted by the kernel.\nThe risk is categorized as high for local users or attackers with the capability to manipulate kernel-level data structures, as it could lead to kernel memory leakage.\nSuccessful exploitation requires no specific network access, as the vulnerability resides in local hardware interface parsing logic; however, it necessitates elevated privileges or local device access to supply the malformed table.",
  "technicalDetails": "The vulnerability is located in the CRAT parser logic within the Linux kernel's AMD KFD driver. The parser is responsible for interpreting the Component Resource Affinity Table, which describes hardware resource topology.\nThe root cause is an insufficient bounds check during the validation of subtype structures. While the parser verifies that the subtype header exists within the memory image, it fails to perform a secondary validation against the 'length' field advertised within the header itself.\nWhen kfd_parse_subtype() processes a CRAT entry, it casts the header to a specific subtype structure based on the type field. If an attacker provides a malformed table where the length field exceeds the remaining buffer size, the pointer arithmetic performed by the function will resolve to an address outside the legitimate memory image.\nExploitation occurs when the system consumes this malformed table; the function proceeds to read from the out-of-bounds memory address under the assumption that the data is a valid subtype structure. This leads to an OOB read, which could expose sensitive kernel memory contents or cause a kernel panic due to an unaligned or illegal memory access.\nThe attack flow involves the following sequence: 1) The KFD driver attempts to initialize or re-scan the topology; 2) The parser iterates through the CRAT image; 3) The parser encounters a malicious or malformed subtype entry with an inflated length; 4) The lack of validation allows the parser to treat adjacent kernel memory as part of the subtype structure; 5) The function reads from the OOB memory, potentially leaking private data or triggering a segmentation fault/kernel crash.\nThis vulnerability affects versions of the Linux kernel where the AMD KFD parser does not check if 'sub_type_hdr + length' stays within the established image boundary. The vulnerability was resolved by ensuring the parser explicitly verifies that the calculated end of the subtype does not exceed the total CRAT image size before accessing internal fields."
}