{"id":"CVE-2026-46197","title":"drm/amdkfd: validate SVM ioctl nattr against buffer size","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: validate SVM ioctl nattr against buffer size\n\nValidate nattr field against the buffer size, preventing\nout-of-bounds buffer access via user-controlled attri…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < daa8bc5f83814b55b71d2b5b3a090d57a5219c21","Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < fb07a0c9c8419164812e07274947f11b1d92dd61","Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < 91c6dc5a41695d02dfc6299f106ac38a6c493e52","Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < ccd060b5c7cc75ae7e211c250b97c5b6272e7efc","Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < db9530a9873a7c85d2266a922589ebcf427fa631","Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < 6abd3a4417cb73a7d0db7e25bf11fae1074bdba3","Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < 045e0ff208f0838a246c10204105126611b267a1","Linux 5.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:20:59.237887Z"},"published":"2026-05-28","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:31:07.454Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46197","references":[{"url":"https://git.kernel.org/stable/c/daa8bc5f83814b55b71d2b5b3a090d57a5219c21"},{"url":"https://git.kernel.org/stable/c/fb07a0c9c8419164812e07274947f11b1d92dd61"},{"url":"https://git.kernel.org/stable/c/91c6dc5a41695d02dfc6299f106ac38a6c493e52"},{"url":"https://git.kernel.org/stable/c/ccd060b5c7cc75ae7e211c250b97c5b6272e7efc"},{"url":"https://git.kernel.org/stable/c/db9530a9873a7c85d2266a922589ebcf427fa631"},{"url":"https://git.kernel.org/stable/c/6abd3a4417cb73a7d0db7e25bf11fae1074bdba3"},{"url":"https://git.kernel.org/stable/c/045e0ff208f0838a246c10204105126611b267a1"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.06638,"ingestedAt":"2026-10-16T17:24:46.711Z","slug":"CVE-2026-46197","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: validate SVM ioctl nattr against buffer size\n\nValidate nattr field against the buffer size, preventing\nout-of-bounds buffer access via user-controlled attribute count.\n\n(cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f)\n\n## Affected\n\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < daa8bc5f83814b55b71d2b5b3a090d57a5219c21`\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < fb07a0c9c8419164812e07274947f11b1d92dd61`\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < 91c6dc5a41695d02dfc6299f106ac38a6c493e52`\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < ccd060b5c7cc75ae7e211c250b97c5b6272e7efc`\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < db9530a9873a7c85d2266a922589ebcf427fa631`\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < 6abd3a4417cb73a7d0db7e25bf11fae1074bdba3`\n- `Linux >= 42de677f79999791bee4e21be318c32d90ab62c6 < 045e0ff208f0838a246c10204105126611b267a1`\n- `Linux 5.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}