CVE-2026-68257

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Triggered through the AMDKFD_IOC_CREATE_QUEUE ioctl on the local /dev/kfd character device; the attacker-controlled ctx_save_restore_size field comes straight from the ioctl argument struct with no remote reachability.

AC:LAttack complexity, low

The overflow is pure deterministic arithmetic on a value the attacker fully controls — passing ctx_save_restore_size near 2^32 (or /NUM_XCC on multi-XCC MI300 parts) reliably wraps total_cwsr_size to 0 or a small value on every attempt, with no race or layout dependency.

PR:LPrivileges required, low

Requires only an unprivileged local account with access to /dev/kfd, which is granted to the render group and is routinely available to ordinary users on ROCm hosts, GPU compute nodes, containers, Steam Deck/desktop and Chrome OS style systems; no capabilities are checked on this path.

UI:NUser interaction, none

The attacker creates the malicious compute queue entirely from its own process via a single ioctl; no action by any other user or administrator is needed.

S:UScope, unchanged

The undersized CWSR area and the resulting firmware overrun stay within the kernel/GPU driver security authority of the same machine; there is no hypervisor or IOMMU boundary crossed.

C:HConfidentiality impact, high

With validation bypassed, CP firmware save/restore reads span memory adjacent to the tiny validated buffer and load it into wave state the attacker's shader can read back, and get_wave_state copies per-XCC control-stack contents out of the unvalidated region, giving a broad out-of-bounds disclosure primitive.

I:HIntegrity impact, high

The queue is programmed with the full unwrapped save size and per-XCC base offsets, so firmware performs large out-of-bounds writes of wave/control-stack data beyond the buffer that was actually validated and reference-counted, and the bypassed queue_refcount lets those buffers be unmapped or freed while the queue is live — an attacker-influenced memory-corruption primitive.

A:HAvailability impact, high

Overrunning the CWSR save area drives the GPU into unmapped VA on preemption, causing VM faults, queue hangs and driver-initiated GPU resets that take down all GPU workloads on the machine, including other tenants on shared compute nodes.