---
id: CVE-2026-80747
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdkfd: Add bounds check for CRAT subtype length

  The CRAT parser validates that the subtype header fits within the image,
  but does not verify that the advertised s…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdkfd: Add bounds check for CRAT subtype length

  The CRAT parser validates that the subtype header fits within the image,
  but does not verify that the advertised s…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5b5c4e40a37e858e2bff8cd91be8e972256392c4 <
    69164d6bdad5d6657e51436a3f602822f620a46a
  - >-
    Linux >= 5b5c4e40a37e858e2bff8cd91be8e972256392c4 <
    ca91e0cc8087568e4b791648a7c01e804f48cb73
  - >-
    Linux >= 5b5c4e40a37e858e2bff8cd91be8e972256392c4 <
    6e7566ba4739dd573c331adde1c96690f7a567bd
  - Linux 3.19
published: '2026-09-03'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:52.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80747'
references:
  - url: 'https://git.kernel.org/stable/c/69164d6bdad5d6657e51436a3f602822f620a46a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e7566ba4739dd573c331adde1c96690f7a567bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ca91e0cc8087568e4b791648a7c01e804f48cb73'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00171
epssPercentile: 0.06041
ingestedAt: '2026-10-15T11:00:41.662Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Add bounds check for CRAT subtype length

The CRAT parser validates that the subtype header fits within the image,
but does not verify that the advertised subtype length fits. A malformed
CRAT table with an oversized length field causes out-of-bounds reads when
kfd_parse_subtype() casts the header to specific subtype structures.

Add validation that sub_type_hdr + length does not exceed the image
boundary before parsing the subtype contents.

(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.