---
id: CVE-2026-68257
title: 'drm/amdkfd: fix 32-bit overflow in CWSR total size calculation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

  total_cwsr_size was computed in 32-bit before being used as a BO/SVM
  allocation size.
  With large ctx_sav…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 325aa07165394b8e866ffe9ec1d4c99d9195b2f2 <
    b88ffe6593607364a8c06a48c6f29e55437cdf8e
  - >-
    Linux >= d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 <
    abce3276c57e36c955627307469b9f009057a467
  - >-
    Linux >= d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 <
    865532d54eb57b660b1cb1b0e1755776ce21b849
  - >-
    Linux >= d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 <
    2b0386d4293920e690c0e017708f999b93cc729b
  - Linux 63600103d2ac5c09fdeec5b931b396e4e0efd5d8
  - Linux >= 6.12.59 < 6.12.101
  - Linux >= 6.17.9 < 6.18
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:46:15.764782Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:04.998Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68257'
references:
  - url: 'https://git.kernel.org/stable/c/b88ffe6593607364a8c06a48c6f29e55437cdf8e'
  - url: 'https://git.kernel.org/stable/c/abce3276c57e36c955627307469b9f009057a467'
  - url: 'https://git.kernel.org/stable/c/865532d54eb57b660b1cb1b0e1755776ce21b849'
  - url: 'https://git.kernel.org/stable/c/2b0386d4293920e690c0e017708f999b93cc729b'
tags:
  - cve.org
epss: 0.00138
epssPercentile: 0.02846
ingestedAt: '2026-10-16T17:24:46.856Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

total_cwsr_size was computed in 32-bit before being used as a BO/SVM
allocation size.
With large ctx_save_restore_area_size and debug_memory_size
multiplied by the XCC count, the product can wrap,
yielding an undersized CWSR save area that firmware later overruns.

Promote total_cwsr_size to u64 and use check_add_overflow()/
check_mul_overflow() in both kfd_queue_acquire_buffers() and
kfd_queue_release_buffers().

(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)

## Affected

- `Linux >= 325aa07165394b8e866ffe9ec1d4c99d9195b2f2 < b88ffe6593607364a8c06a48c6f29e55437cdf8e`
- `Linux >= d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 < abce3276c57e36c955627307469b9f009057a467`
- `Linux >= d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 < 865532d54eb57b660b1cb1b0e1755776ce21b849`
- `Linux >= d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 < 2b0386d4293920e690c0e017708f999b93cc729b`
- `Linux 63600103d2ac5c09fdeec5b931b396e4e0efd5d8`
- `Linux >= 6.12.59 < 6.12.101`
- `Linux >= 6.17.9 < 6.18`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.