From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABEFD3DEAE3 for ; Wed, 27 May 2026 12:21:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884506; cv=none; b=Z+1080+jG5Ti5Tq5fSn89AL2vNmN4452UG+JuAwFKPSsNI7kt7OidCIu6am5LtgWCXUVLQPnmcofJbHcuj8ITBqfQn7qin98LNeAcnf8BmCZblCe/EWL8d8goau0zfqVKgYqEbQtPkWp2ybRTwIyFBl0Ha5BKF2tOVkdN5/n0QM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884506; c=relaxed/simple; bh=YnSQLahJF/KACe7m614ffRrvk2zsCWWIFDwVKpdqnNQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qirj6giASl74nCfW+jZOfL9JCyYUvMj801t9nWl4JqDFo+xlRWnESP/ceUqR1FWDu5VJqyU7I4Zq6sToC1kP3bqWAOQjUAX7vH7ePh9Ey5Ti2h6kVIBpnSXDANI4rQ2WY59OsN7tud0TsK2T9Vz8uBb7xZsrNzX7jKIT2/xHMpY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yU6MV198; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yU6MV198" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04C7F1F00A3C; Wed, 27 May 2026 12:21:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779884505; bh=Y8wVrkr/RUYZG1/A80fnbZphIL/o9Q/UTD4wEHAexg4=; h=From:To:Cc:Subject:Date:Reply-To; b=yU6MV198C6wRd+c5Rte1NIKEiIaCU77pO4RD980VilVWyuejhSd4s1cteEk7W6Tcm L4Rxro5rc9KxLbRSXSu0xjP4BD8fjLp0Hx5ZvWVsCx5T762PKX9seB5xyWpgf/2EIT hvWB5usmC0PXUsAx5/7/bVoFDcdBkcWttzmfoJCs= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-45853: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() Date: Wed, 27 May 2026 14:18:15 +0200 Message-ID: <2026052709-CVE-2026-45853-9163@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2627; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=FEjb6anvxWe9fzbBUWyr9ZANz2/Kgcig7jWstsKd8RU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFliDxm9KqTr+lOL76lznavxmJ10VtR2ymvDrNd/L/3fe uVSx6a1HbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjAR0RyGeaYz9Pz3/mh9+Nfj 0en8t23HJu6bFcgwV/KOVBK7p+XOle6bLY5PVtvY1ZUkBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() amdgpu_discovery_get_nps_info() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption. Use kvfree() to safely handle both kmalloc and vmalloc allocations. Compile tested only. Issue found using a prototype static analysis tool and code review. The Linux kernel CVE team has assigned CVE-2026-45853 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 6.12.75 with commit 16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 6.18.14 with commit 9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5 Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 6.19.4 with commit f441538893eba6347b983f2904819ca6c99da65e Issue introduced in 6.11 with commit b194d21b9bcc15b50df1bc3ff7428e51c2918a6f and fixed in 7.0 with commit 0c44d61945c4a80775292d96460aa2f22e62f86c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-45853 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e https://git.kernel.org/stable/c/9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5 https://git.kernel.org/stable/c/f441538893eba6347b983f2904819ca6c99da65e https://git.kernel.org/stable/c/0c44d61945c4a80775292d96460aa2f22e62f86c