Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc

The low 6 bits of cp_hqd_eop_control store the base-2 logarithm
of the EOP ring size. This was calculated as

ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1

But ffs can in theory return 1 or 0, so this could underflow
(although in practice the ring buffer size cannot be less than 4096).

Change this to

ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)

using properties of logarithms.

(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)
Published: 2026-10-06
Score: 7.0 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of service via kernel crash
Action: Apply patch
AI Analysis

Impact

The vulnerability results from an integer underflow in the calculation of the Event Output Pointer ring size within the AMD KFD driver. The logic used the ffs function, which can return 1 or 0, leading the calculation to underflow and store an incorrect value in the control register. This incorrect value could corrupt kernel data structures and cause a kernel crash or system outage.

Affected Systems

All Linux kernel releases that include the AMD KFD driver before the implementation of the patched calculation are affected. No specific version numbers are listed, so any kernel containing the vulnerable logic may be impacted.

Risk and Exploitability

The CVSS score of 7.0 indicates high severity, while the EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating no known public exploits. An attack vector appears to require local or privileged access to the device through the AMD KFD driver, which limits exploitation to systems where a user can interact with that driver or has administrative privileges.

Generated by OpenCVE AI on October 9, 2026 at 03:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel update that includes commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a, which changes the ring size calculation to use ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4).
  • Upgrade the operating system to a kernel version that incorporates the updated AMD KFD driver.
  • If an immediate kernel upgrade is not possible, disable the AMD KFD driver or restrict access to its device nodes until the patch is applied.

Generated by OpenCVE AI on October 9, 2026 at 03:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
References

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-191
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Low

Wed, 07 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Tue, 06 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1 But ffs can in theory return 1 or 0, so this could underflow (although in practice the ring buffer size cannot be less than 4096). Change this to ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4) using properties of logarithms. (cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)
Title drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-11-06T17:14:59.026Z

Reserved: 2026-09-25T10:25:14.322Z

Link: CVE-2026-98176

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:17:59.653

Modified: 2026-11-06T18:18:28.800

Link: CVE-2026-98176

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98176 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T03:15:15Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)