From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B303C3DCDAA for ; Wed, 27 May 2026 12:21:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884494; cv=none; b=u48N3o3rV93Wdr9SLB2dzEXThbGieqCQgevqknwh5Le9SgBbiclPl9IkgPNLN2uNJ8/PXt5RR8CVJ+ABn3fSQepKgvB4NvIZ67M1flPfhaXl7Aa+Qyaq0l+KykXh8/XuzJxIun6wzZikD/kfbc0J5/wRMRqo5G+ibQDFNhw8Dkw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779884494; c=relaxed/simple; bh=7jNCZbBYRq5URPKwFd3Z1y9qYJhQrVXUWnXbBP9gCHo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RGtrEqUQEGjTkawxm94zTJcC9v2O8azNVtGK82qE9GqG/FQFvGQDK4EJgNmwG6MKxYtF5zjSrqrDu4s2ATgkHHdoix8lG7FCgH1OQI8TQB2sSHod7134cBywVcPZ9t6XD00tGhkckcjTIFQuYxdHlmDDkE8n8+UGmnRg3oMoKk8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dIq+kdoe; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dIq+kdoe" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A499A1F000E9; Wed, 27 May 2026 12:21:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779884493; bh=gpYCD3MMjPmY8AkRzNyGiIExG3cDZAnd+jeYrXxohLA=; h=From:To:Cc:Subject:Date:Reply-To; b=dIq+kdoelrnRhl2YWsRveVI0/6HE62f6EFwxhhM1IWLAjy2btyJyFt39J9icD7Oxw 1OUBayKXZC1pxWq71iIrutbUYazLrtnqevGLoA0aA5fifzVOmd6t4gWzlQOk/fFuPG 4OGM2QdShs8ursy47DgMGUiMnfPrUnGP3Q6CEbtg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 Date: Wed, 27 May 2026 14:18:40 +0200 Message-ID: <2026052714-CVE-2026-45878-b59f@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4622; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=9ehkoTSaAdechsglqBeVEPjlEny47KZUh9rDvEGsm90=; b=owGbwMvMwCRo6H6F97bub03G02pJDFliD9n+61mu+N8VrnF72U7NzhwWgVffBHd2uHKdaLwp2 8DjvVq6I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACayjZthwdz4gp/Rdd/PFqdN MnrxRp4lY0pqN8OC5Rw6swoP9YnHLZ+ffvPoNpaXV/JjAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id. If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array. drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely. This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, 434 uint32_t watch_id) 435 { 436 int r; 437 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id)) kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined). 439 return -EINVAL; 440 441 if (!pdd->dev->kfd->shared_resources.enable_mes) { 442 r = debug_lock_and_unmap(pdd->dev->dqm); 443 if (r) 444 return r; 445 } 446 447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false); --> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch( 449 pdd->dev->adev, 450 watch_id); v2: (as per, Jonathan Kim) - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path. - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id(). The Linux kernel CVE team has assigned CVE-2026-45878 to this issue. Affected and fixed versions =========================== Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.6.128 with commit 971bf8e61e9b4abaacf9b35eaf76ec222758f9d6 Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.12.75 with commit a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488 Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.18.14 with commit 2b36c0c1bcbbe15f6cfa9652084b3124c835a150 Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 6.19.4 with commit 3c38a0f07aa2bfef2b219b1f045534ad93f85afd Issue introduced in 6.5 with commit e0f85f4690d089cc1a60337decafb1acf7eec45e and fixed in 7.0 with commit 5a19302cab5cec7ae7f1a60c619951e6c17d8742 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-45878 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/amdkfd/kfd_debug.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6 https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488 https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150 https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742