CVE-2026-45878: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45878 Overview

CVE-2026-45878 is a bounds checking vulnerability in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) debug subsystem. The flaw exists in the address watch handling code within drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c. The watch_id parameter is received as an unsigned 32-bit value from userspace, but helper functions treat it as a signed integer during bit-shift operations. A sufficiently large watch_id value converts to a negative number, producing undefined behavior through invalid shifts and enabling out-of-bounds access to the pdd->watch_points array.

Critical Impact

Userspace can trigger a buffer overflow in kernel memory by supplying a crafted watch_id, leading to undefined behavior and potential kernel memory corruption.

Affected Products

• Linux kernel — drm/amdkfd subsystem (AMD Kernel Fusion Driver debug code)
• Builds containing kfd_dbg_trap_clear_dev_address_watch() and kfd_dbg_owns_dev_watch_id() helpers
• Systems exposing the KFD debug interface to unprivileged userspace processes

Discovery Timeline

• 2026-05-27 - CVE-2026-45878 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45878

Vulnerability Analysis

The vulnerability resides in the AMD KFD debug address watch clear path. The function kfd_dbg_trap_clear_dev_address_watch() accepts watch_id as a uint32_t from userspace. Internal helpers including kfd_dbg_owns_dev_watch_id() operate on this value using signed integer arithmetic and bit shifts. When watch_id exceeds INT_MAX, the value sign-extends to a negative integer in signed contexts.

Negative shift operands are undefined behavior in C. Static analysis flagged the issue at line 448, where pdd->watch_points[watch_id] is dereferenced after an incomplete bounds check. The reported analyzer output shows 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped, indicating the array of size four can be indexed with attacker-controlled values up to u32max.

Root Cause

The root cause is an input validation error [CWE-129]. kfd_dbg_owns_dev_watch_id() did not validate that watch_id is less than MAX_WATCH_ADDRESSES before performing shift operations. The bounds check was incomplete in both the set and clear paths. A signed/unsigned mismatch between the userspace-supplied u32 and internal signed int handling allowed values above INT_MAX to bypass checks.

Attack Vector

A local userspace process with access to the KFD debug ioctl interface supplies a watch_id value greater than MAX_WATCH_ADDRESSES. The kernel performs an out-of-bounds write into pdd->watch_points[watch_id] using the return value of clear_address_watch(). The patched code adds an early watch_id >= MAX_WATCH_ADDRESSES check in the set path to mirror the clear path, removes the redundant bounds check in kfd_dbg_owns_dev_watch_id(), and uses the BIT(watch_id) macro to test and clear bits safely.

// No verified exploit code available. See kernel commit references for the
// upstream patch and full technical context.

Detection Methods for CVE-2026-45878

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing kfd_dbg_trap_clear_dev_address_watch or kfd_debug.c in dmesg output.
• KASAN or UBSAN reports flagging out-of-bounds writes on the pdd->watch_points array or undefined shift operations in the amdkfd debug path.
• Unprivileged processes issuing repeated KFD debug ioctls with anomalous watch_id parameter values.

Detection Strategies

• Enable CONFIG_KASAN and CONFIG_UBSAN on test kernels to catch out-of-bounds writes and undefined shift behavior triggered by this code path.
• Audit kernel package versions across the fleet against the fixed commits listed in the kernel.org references to identify unpatched hosts.
• Monitor system call telemetry for processes opening /dev/kfd and issuing debug ioctls, correlating with crash events.

Monitoring Recommendations

• Collect kernel logs centrally and alert on stack traces containing amdkfd or kfd_debug symbols.
• Track kernel version inventory for AMD GPU compute hosts to confirm patch coverage.
• Review audit logs for unexpected use of GPU debug interfaces by non-developer accounts.

How to Mitigate CVE-2026-45878

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced in the kernel.org stable commits and rebuild or update affected kernels.
• Prioritize patching on multi-tenant systems and AI/HPC nodes running AMD GPU compute workloads where untrusted code may execute.
• Restrict access to the KFD debug interface to trusted users until kernels are updated.

Patch Information

The fix validates watch_id < MAX_WATCH_ADDRESSES in both the set and clear paths, removes the redundant bounds check in kfd_dbg_owns_dev_watch_id(), and replaces manual shifts with the BIT(watch_id) macro. See the upstream commits: Kernel Commit 2b36c0c, Kernel Commit 3c38a0f, Kernel Commit 5a19302c, Kernel Commit 971bf8e6, and Kernel Commit a0d367e1.

Workarounds

• Limit access to /dev/kfd using filesystem permissions or device cgroup rules so only trusted accounts can invoke KFD debug ioctls.
• Disable or unload the amdkfd debug functionality on systems that do not require GPU debugging.
• Apply distribution vendor kernel updates as soon as they include the referenced stable commits.

# Verify the running kernel version and check for amdkfd module
uname -r
lsmod | grep amdkfd

# Restrict access to the KFD device node to a trusted group
sudo chgrp gpu-debug /dev/kfd
sudo chmod 0660 /dev/kfd