Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in get_wave_state() The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD, which are written by GPU microcode and fully attacker-controlled on the CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3). this leads to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB read length, if size is set to 1 MiB against a 4 KiB allocation, we leak 1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR pointers). Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the clamped size before performing arithmetic and copy_to_user(). This ensures we never read beyond the allocated kernel BO regardless of attacker-supplied MQD field values.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-24T17:17:27.290Z",
  "pubdate": "2026-09-24T17:17:27.290Z",
  "executiveSummary": "The Linux kernel's amdkfd (AMD Kernel Fusion Driver) contains an out-of-bounds (OOB) memory exposure vulnerability within the get_wave_state() function.\nThe vulnerability arises from insufficient validation of user-supplied or microcode-supplied values residing in the Memory Queue Descriptor (MQD).\nAn attacker can exploit the CRIU-restore path via the AMDKFD_IOC_RESTORE_PROCESS ioctl to supply malicious cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values.\nThis flaw allows for an arbitrary-sized copy_to_user() operation, leading to the unauthorized disclosure of sensitive adjacent kernel memory, including GTT memory, other queue MQDs, ring buffers, and potential KASLR base pointers.\nThe risk is high as it facilitates information leakage, which can be leveraged to bypass kernel security protections such as KASLR, facilitating further exploitation.\nExploitation requires the ability to interact with the AMDKFD interface, typically accessible to users with appropriate device file permissions.",
  "technicalDetails": "The root cause of this vulnerability is an implicit trust model within the get_wave_state() function for v9 hardware, which consumes cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset fields directly from the MQD structure without bounds verification.\nDuring the CRIU (Checkpoint/Restore in Userspace) restoration flow, specifically when calling AMDKFD_IOC_RESTORE_PROCESS, these MQD fields are populated. Because the kernel relies on these untrusted values to determine the length and offset of a copy_to_user() operation, an attacker can manipulate these parameters to trigger an out-of-bounds read.\nThe exploitation flow proceeds as follows: 1) An attacker crafts a malicious MQD state where cp_hqd_cntl_stack_size exceeds the size of the underlying allocated buffer (q->ctl_stack_size) or where cp_hqd_cntl_stack_offset is manipulated to cause arithmetic underflow.\n2) If the offset is greater than the size, the resulting integer underflow manifests as an extremely large unsigned integer, forcing copy_to_user() to attempt a multi-gigabyte memory read.\n3) Alternatively, by setting a large size value against a small buffer allocation (e.g., 1 MiB size for a 4 KiB buffer), the kernel performs a massive copy operation that reads into memory segments physically adjacent to the target kernel buffer.\n4) The copied data, which may contain sensitive kernel structures, ring buffers, or pointers, is then returned to the attacker's userspace buffer via copy_to_user().\nThis vulnerability effectively turns a legitimate diagnostic interface into a primitive for arbitrary kernel memory disclosure. By reading adjacent MQD structures, an attacker can extract metadata, command stream information, or pointers necessary to compute the kernel memory layout (KASLR defeat). The lack of input sanitization within get_wave_state() fails to enforce the physical boundaries of the allocated Kernel Buffer Object (BO), allowing the attacker to bypass kernel-level memory isolation."
}