CVE-2026-45878 Overview
CVE-2026-45878 is a bounds checking vulnerability in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) debug subsystem. The flaw exists in the address watch handling code within drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c. The watch_id parameter is received as an unsigned 32-bit value from userspace, but helper functions treat it as a signed integer during bit-shift operations. A sufficiently large watch_id value converts to a negative number, producing undefined behavior through invalid shifts and enabling out-of-bounds access to the pdd->watch_points array.
Critical Impact
Userspace can trigger a buffer overflow in kernel memory by supplying a crafted watch_id, leading to undefined behavior and potential kernel memory corruption.
Affected Products
- Linux kernel — drm/amdkfd subsystem (AMD Kernel Fusion Driver debug code)
- Builds containing kfd_dbg_trap_clear_dev_address_watch() and kfd_dbg_owns_dev_watch_id() helpers
- Systems exposing the KFD debug interface to unprivileged userspace processes
Discovery Timeline
- 2026-05-27 - CVE-2026-45878 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45878
Vulnerability Analysis
The vulnerability resides in the AMD KFD debug address watch clear path. The function kfd_dbg_trap_clear_dev_address_watch() accepts watch_id as a uint32_t from userspace. Internal helpers including kfd_dbg_owns_dev_watch_id() operate on this value using signed integer arithmetic and bit shifts. When watch_id exceeds INT_MAX, the value sign-extends to a negative integer in signed contexts.
Negative shift operands are undefined behavior in C. Static analysis flagged the issue at line 448, where pdd->watch_points[watch_id] is dereferenced after an incomplete bounds check. The reported analyzer output shows 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped, indicating the array of size four can be indexed with attacker-controlled values up to u32max.
Root Cause
The root cause is an input validation error [CWE-129]. kfd_dbg_owns_dev_watch_id() did not validate that watch_id is less than MAX_WATCH_ADDRESSES before performing shift operations. The bounds check was incomplete in both the set and clear paths. A signed/unsigned mismatch between the userspace-supplied u32 and internal signed int handling allowed values above INT_MAX to bypass checks.
Attack Vector
A local userspace process with access to the KFD debug ioctl interface supplies a watch_id value greater than MAX_WATCH_ADDRESSES. The kernel performs an out-of-bounds write into pdd->watch_points[watch_id] using the return value of clear_address_watch(). The patched code adds an early watch_id >= MAX_WATCH_ADDRESSES check in the set path to mirror the clear path, removes the redundant bounds check in kfd_dbg_owns_dev_watch_id(), and uses the BIT(watch_id) macro to test and clear bits safely.
// No verified exploit code available. See kernel commit references for the
// upstream patch and full technical context.
Detection Methods for CVE-2026-45878
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing kfd_dbg_trap_clear_dev_address_watch or kfd_debug.c in dmesg output.
- KASAN or UBSAN reports flagging out-of-bounds writes on the pdd->watch_points array or undefined shift operations in the amdkfd debug path.
- Unprivileged processes issuing repeated KFD debug ioctls with anomalous watch_id parameter values.
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_UBSAN on test kernels to catch out-of-bounds writes and undefined shift behavior triggered by this code path.
- Audit kernel package versions across the fleet against the fixed commits listed in the kernel.org references to identify unpatched hosts.
- Monitor system call telemetry for processes opening /dev/kfd and issuing debug ioctls, correlating with crash events.
Monitoring Recommendations
- Collect kernel logs centrally and alert on stack traces containing amdkfd or kfd_debug symbols.
- Track kernel version inventory for AMD GPU compute hosts to confirm patch coverage.
- Review audit logs for unexpected use of GPU debug interfaces by non-developer accounts.
How to Mitigate CVE-2026-45878
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org stable commits and rebuild or update affected kernels.
- Prioritize patching on multi-tenant systems and AI/HPC nodes running AMD GPU compute workloads where untrusted code may execute.
- Restrict access to the KFD debug interface to trusted users until kernels are updated.
Patch Information
The fix validates watch_id < MAX_WATCH_ADDRESSES in both the set and clear paths, removes the redundant bounds check in kfd_dbg_owns_dev_watch_id(), and replaces manual shifts with the BIT(watch_id) macro. See the upstream commits: Kernel Commit 2b36c0c, Kernel Commit 3c38a0f, Kernel Commit 5a19302c, Kernel Commit 971bf8e6, and Kernel Commit a0d367e1.
Workarounds
- Limit access to /dev/kfd using filesystem permissions or device cgroup rules so only trusted accounts can invoke KFD debug ioctls.
- Disable or unload the amdkfd debug functionality on systems that do not require GPU debugging.
- Apply distribution vendor kernel updates as soon as they include the referenced stable commits.
# Verify the running kernel version and check for amdkfd module
uname -r
lsmod | grep amdkfd
# Restrict access to the KFD device node to a trusted group
sudo chgrp gpu-debug /dev/kfd
sudo chmod 0660 /dev/kfd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
