CVE-2026-63881 Overview
CVE-2026-63881 is an integer overflow vulnerability in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) debugger subsystem. The flaw resides in the get_queue_ids() function, which calculates array_size = num_queues * sizeof(uint32_t) without overflow protection. On 32-bit size_t builds, this multiplication can wrap, producing an undersized allocation that leads to subsequent memory corruption. The kernel maintainers resolved the issue by switching to the array_size() helper, which saturates to SIZE_MAX on overflow.
Critical Impact
A local, authenticated user with access to the AMD KFD debugger interface can trigger an integer overflow that corrupts kernel memory, enabling privilege escalation, denial of service, or arbitrary code execution in kernel context.
Affected Products
- Linux kernel builds shipping the drm/amdkfd driver on 32-bit size_t architectures
- Distributions consuming the affected AMD KFD debugger code prior to the referenced stable commits
- Systems exposing the KFD debugger ioctl interface to unprivileged local users
Discovery Timeline
- 2026-07-19 - CVE-2026-63881 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63881
Vulnerability Analysis
The vulnerability lives in the AMD Kernel Fusion Driver (amdkfd), the kernel component that brokers GPU compute queues for user-space processes. Its debugger path exposes an ioctl that returns queue identifiers to a caller. Inside get_queue_ids(), the driver computes the byte size for a queue-ID buffer using an unchecked multiplication: array_size = num_queues * sizeof(uint32_t).
On architectures where size_t is 32 bits, a sufficiently large num_queues value causes the multiplication to wrap. The kernel then allocates a buffer smaller than the caller-declared element count. Subsequent writes iterate over num_queues entries and overflow the allocation, corrupting adjacent kernel heap objects.
The upstream fix replaces the raw multiplication with the array_size() helper, which detects overflow and returns SIZE_MAX. The allocator then rejects the request rather than returning a truncated buffer. The change was backported across stable trees in commits 4e5f808, 4f9eeed, 5cf4a41, 93f5534, and de70a80.
Root Cause
The root cause is missing overflow validation on a size calculation used for a heap allocation [CWE-190]. The product of an attacker-controlled queue count and a fixed element size can silently wrap on 32-bit size_t builds, producing a heap buffer overflow when the driver later fills the allocation.
Attack Vector
Exploitation requires local access and low privileges on a system exposing the KFD debugger interface. An attacker calls the debugger ioctl with a crafted num_queues value chosen to overflow the size computation. The undersized allocation is then written past its bounds by the driver, giving the attacker a controlled kernel heap corruption primitive suitable for privilege escalation.
No verified public proof-of-concept is available. The vulnerability mechanism is documented in the upstream commits referenced in the Kernel Git Commit 4e5f808 and Kernel Git Commit de70a80 patches.
Detection Methods for CVE-2026-63881
Indicators of Compromise
- Unexpected kernel oops or SLUB/SLAB corruption messages referencing amdkfd or kfd_ioctl_dbg_trap in dmesg
- Local processes invoking KFD debugger ioctls with abnormally large num_queues argument values
- Unexplained privilege elevation of processes that recently opened /dev/kfd
Detection Strategies
- Audit ioctl calls to /dev/kfd with focus on debugger trap operations and unusual argument sizes
- Enable KASAN on test kernels to surface heap out-of-bounds writes originating in get_queue_ids()
- Monitor kernel ring buffer for stack traces containing amdkfd symbols followed by memory corruption warnings
Monitoring Recommendations
- Track processes opening /dev/kfd and correlate with subsequent UID transitions or new kernel modules loading
- Alert on kernel panics or WARN events involving kfd_dbg functions across the fleet
- Collect and centralize auditd records for ioctl syscalls on KFD device nodes
How to Mitigate CVE-2026-63881
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 4e5f808, 4f9eeed, 5cf4a41, 93f5534, and de70a80
- Update to distribution kernels that incorporate the array_size() fix in drm/amdkfd
- Restrict access to /dev/kfd to trusted users and workloads only
Patch Information
The fix replaces the vulnerable multiplication in get_queue_ids() with the overflow-safe array_size() helper. Refer to Kernel Git Commit 4e5f808, Kernel Git Commit 4f9eeed, Kernel Git Commit 5cf4a41, Kernel Git Commit 93f5534, and Kernel Git Commit de70a80 for the exact changes and backport targets.
Workarounds
- Tighten permissions on /dev/kfd to prevent unprivileged users from invoking KFD debugger ioctls
- Disable the AMD KFD driver on hosts that do not require GPU compute workloads
- Prefer 64-bit kernel builds, where the overflow condition on size_t is not reachable with realistic queue counts
# Restrict access to the KFD device node
sudo chown root:kfd-users /dev/kfd
sudo chmod 0660 /dev/kfd
# Verify the running kernel includes the fix
grep -E 'get_queue_ids|array_size' /proc/kallsyms
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
