{"id":"CVE-2026-43206","title":"drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the b…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 3e04bc310d80b46eaf481f1fefcbcb37a187412d","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < b4034442cb090e4a980bdcc1540948606cbc951b","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 75fb57efdd7863fffbc39db23e9cad7aafda26ed","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 4e72f419e4ed44cb3b60506752d8688c20a60a9b","Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 8a70a26c9f34baea6c3199a9862ddaff4554a96d","Linux 4.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:15:43.887589Z"},"published":"2026-05-06","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:36.526Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43206","references":[{"url":"https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d"},{"url":"https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f"},{"url":"https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b"},{"url":"https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940"},{"url":"https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed"},{"url":"https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b"},{"url":"https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b"},{"url":"https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d"}],"tags":["cve.org"],"epss":0.00139,"epssPercentile":0.02894,"ingestedAt":"2026-10-16T17:24:46.687Z","slug":"CVE-2026-43206","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to  potential privilege\nescalation.\n\n## Affected\n\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 3e04bc310d80b46eaf481f1fefcbcb37a187412d`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < b4034442cb090e4a980bdcc1540948606cbc951b`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 75fb57efdd7863fffbc39db23e9cad7aafda26ed`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 4e72f419e4ed44cb3b60506752d8688c20a60a9b`\n- `Linux >= 0fc8011f89feb8b2c3008583b777d097e1974660 < 8a70a26c9f34baea6c3199a9862ddaff4554a96d`\n- `Linux 4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}