---
id: CVE-2026-63881
title: 'drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

  get_queue_ids() computes array_size = num_queues * sizeof(uint32_t),
  which could overflow on 32-bit…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 <
    4e5f808b454167cc58d7084a407a554d8ddc694d
  - >-
    Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 <
    de70a80992396ee306ee3a2810ad28aa1608ba9b
  - >-
    Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 <
    5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c
  - >-
    Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 <
    4f9eeedc3d3151f8a226fd676c314a813edda5a1
  - >-
    Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 <
    93f5534b35a05ef8a0109c1eefa800062fee810a
  - Linux 6.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:32:47.297110Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:09.585Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63881'
references:
  - url: 'https://git.kernel.org/stable/c/4e5f808b454167cc58d7084a407a554d8ddc694d'
  - url: 'https://git.kernel.org/stable/c/de70a80992396ee306ee3a2810ad28aa1608ba9b'
  - url: 'https://git.kernel.org/stable/c/5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c'
  - url: 'https://git.kernel.org/stable/c/4f9eeedc3d3151f8a226fd676c314a813edda5a1'
  - url: 'https://git.kernel.org/stable/c/93f5534b35a05ef8a0109c1eefa800062fee810a'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.08021
ingestedAt: '2026-10-16T17:24:46.771Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

get_queue_ids() computes array_size = num_queues * sizeof(uint32_t),
which could overflow on 32-bit size_t build. using array_size()
instead, it saturates to SIZE_MAX on overflow.

(cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285)

## Affected

- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 4e5f808b454167cc58d7084a407a554d8ddc694d`
- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < de70a80992396ee306ee3a2810ad28aa1608ba9b`
- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c`
- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 4f9eeedc3d3151f8a226fd676c314a813edda5a1`
- `Linux >= a70a93fa568b4f05aba548dadb673703eccf5480 < 93f5534b35a05ef8a0109c1eefa800062fee810a`
- `Linux 6.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.