CVE-2026-68447: Linux Kernel Information Disclosure Flaw

CVE-2026-68447 Overview

CVE-2026-68447 is a Linux kernel vulnerability in the AMD Kernel Fusion Driver (drm/amdkfd) subsystem. The flaw resides in the Checkpoint/Restore in Userspace (CRIU) checkpoint path for v9 GPU Memory Queue Descriptors (MQDs). The driver copies the MQD control stack using the hardware-reported cp_hqd_cntl_stack_size field without bounding the copy to the allocated Buffer Object (BO) region. When the hardware field exceeds the allocated control stack size, memcpy reads past the BO into adjacent Graphics Translation Table (GTT) memory. The out-of-bounds read can leak kernel data to userspace processes performing CRIU checkpoints.

Critical Impact
A local user invoking CRIU checkpoint operations on AMD GPU queues can trigger an out-of-bounds read that exposes kernel GTT memory contents to userspace.

Affected Products

Linux kernel with AMD Kernel Fusion Driver (amdkfd) enabled
Systems using AMD GPUs with v9 MQD architecture (including v9.4.3 multi-XCC configurations)
Kernel builds supporting CRIU checkpoint/restore for GPU compute queues

Discovery Timeline

2026-08-12 - CVE-2026-68447 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68447

Vulnerability Analysis

The vulnerability affects the CRIU checkpoint routine in the AMD KFD driver's v9 MQD manager. During checkpoint, the driver reads cp_hqd_cntl_stack_size directly from the hardware MQD to determine how many bytes of control stack state to copy back to userspace. This hardware-supplied value is used as the length parameter for memcpy without validation against the actual size of the allocated control stack BO.

When the hardware field reports a value larger than the queue's allocated control stack region, the copy proceeds past the BO boundary into neighboring GTT memory pages. GTT memory may contain unrelated kernel allocations, driver structures, or data from other GPU contexts. The disclosed contents are returned to the userspace CRIU process, resulting in an information disclosure classified as an out-of-bounds read.

The patch introduces a bounded copy by storing the page-aligned control stack BO size in the mqd_manager structure and clamping both the checkpoint copy length and the reported checkpoint size to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). The same bound is applied to the multi-XCC v9.4.3 checkpoint layout.

Root Cause

The root cause is missing input validation on a hardware-controlled length field. The driver trusted cp_hqd_cntl_stack_size from the MQD without comparing it to the software-tracked allocation size before invoking memcpy.

Attack Vector

Exploitation requires local access and the ability to submit GPU compute workloads plus invoke CRIU checkpoint operations on an AMD GPU queue. An attacker manipulates or waits for conditions where the hardware control stack size field exceeds the allocated BO size, then reads the checkpoint output to obtain adjacent kernel GTT memory.

// No verified proof-of-concept code is available.
// The vulnerability manifests when the CRIU checkpoint handler
// executes: memcpy(dst, ctl_stack_src, cp_hqd_cntl_stack_size)
// without clamping cp_hqd_cntl_stack_size to mm->ctl_stack_size.
// See kernel commits referenced below for the exact fix.

Detection Methods for CVE-2026-68447

Indicators of Compromise

Unexpected use of CRIU checkpoint operations targeting AMD GPU compute queues by non-administrative users
Abnormal invocations of the KFD ioctl interface associated with queue checkpoint (AMDKFD_IOC_CRIU_OP) from unprivileged processes
Presence of unpatched AMD KFD driver versions on multi-tenant or shared GPU hosts

Detection Strategies

Audit kernel version and confirm whether the AMD KFD fix commits 426ffae6ecc7 or a0d87beb2660 are applied
Monitor process execution for criu binaries operating on processes with open handles to /dev/kfd
Baseline expected users of GPU checkpoint/restore functionality and alert on deviations

Monitoring Recommendations

Enable Linux audit rules on /dev/kfd open and ioctl syscalls to capture CRIU-related activity
Forward kernel dmesg output to a centralized log store and search for amdkfd warnings related to control stack size
Correlate GPU workload telemetry with process ancestry to identify unusual checkpoint patterns

How to Mitigate CVE-2026-68447

Immediate Actions Required

Apply the upstream Linux kernel patch that clamps the CRIU control stack copy to the BO size
Update to distribution kernel packages that include the referenced stable backports
Restrict access to /dev/kfd to trusted users on multi-tenant systems until patched

Patch Information

The fix stores the page-aligned control stack BO size in the mqd_manager and clamps CRIU checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). The same bound is applied to the v9.4.3 multi-XCC checkpoint path. See the upstream stable commits: Kernel Git Commit 426ffae6ecc7 and Kernel Git Commit a0d87beb2660.

Workarounds

Disable CRIU checkpoint/restore for GPU workloads on affected hosts until the kernel is patched
Limit /dev/kfd device permissions to a restricted group of trusted users
Avoid running untrusted GPU compute workloads on shared systems where kernel memory disclosure would be impactful

bash

# Restrict access to the AMD KFD device to a trusted group
sudo groupadd -r kfd-trusted
sudo chown root:kfd-trusted /dev/kfd
sudo chmod 0660 /dev/kfd

# Verify the loaded kernel includes the fix commits
uname -r
dmesg | grep -i amdkfd