{"id":"CVE-2026-63881","title":"drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n\nget_queue_ids() computes array_size = num_queues * sizeof(uint32_t),\nwhich could overflow on 32-bit…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 4e5f808b454167cc58d7084a407a554d8ddc694d","Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < de70a80992396ee306ee3a2810ad28aa1608ba9b","Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c","Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 4f9eeedc3d3151f8a226fd676c314a813edda5a1","Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 93f5534b35a05ef8a0109c1eefa800062fee810a","Linux 6.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:32:47.297110Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:09.585Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63881","references":[{"url":"https://git.kernel.org/stable/c/4e5f808b454167cc58d7084a407a554d8ddc694d"},{"url":"https://git.kernel.org/stable/c/de70a80992396ee306ee3a2810ad28aa1608ba9b"},{"url":"https://git.kernel.org/stable/c/5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c"},{"url":"https://git.kernel.org/stable/c/4f9eeedc3d3151f8a226fd676c314a813edda5a1"},{"url":"https://git.kernel.org/stable/c/93f5534b35a05ef8a0109c1eefa800062fee810a"}],"tags":["cve.org"],"epss":0.00189,"epssPercentile":0.08021,"ingestedAt":"2026-10-16T17:24:46.771Z","slug":"CVE-2026-63881","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n\nget_queue_ids() computes array_size = num_queues * sizeof(uint32_t),\nwhich could overflow on 32-bit size_t build. using array_size()\ninstead, it saturates to SIZE_MAX on overflow.\n\n(cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285)\n\n## Affected\n\n- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 4e5f808b454167cc58d7084a407a554d8ddc694d`\n- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < de70a80992396ee306ee3a2810ad28aa1608ba9b`\n- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c`\n- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 4f9eeedc3d3151f8a226fd676c314a813edda5a1`\n- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 93f5534b35a05ef8a0109c1eefa800062fee810a`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}