{"id":"CVE-2026-45878","revision":"d6bca3daa32b44608e93433cac45ebbf","records":[{"revision":"d6bca3daa32b44608e93433cac45ebbf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45878","aliases":[],"title":"drm/amdkfd: Fix watch_id bounds checking in debug address watch v2","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nThe address watch clear code receives watch_id as an unsigned value\n(u32), but some helper functions were using a signed int and checked\nbits by shifting with watch_id.\n\nIf a very large watch_id is passed from userspace, it can be converted\nto a negative value. This can cause invalid shifts and may access\nmemory outside the watch_points array.\n\ndrm/amdkfd: Fix watch_id bounds checking in debug address watch v2\n\nFix this by checking that watch_id is within MAX_WATCH_ADDRESSES before\nusing it. Also use BIT(watch_id) to test and clear bits safely.\n\nThis keeps the behavior unchanged for valid watch IDs and avoids\nundefined behavior for invalid ones.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448\nkfd_dbg_trap_clear_dev_address_watch() error: buffer overflow\n'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped\n\ndrivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c\n 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,\n 434 uint32_t watch_id)\n 435 {\n 436 int r;\n 437\n 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))\n\nkfd_dbg_owns_dev_watch_id() doesn't check for negative values so if\nwatch_id is larger than INT_MAX it leads to a buffer overflow.\n(Negative shifts are undefined).\n\n 439 return -EINVAL;\n 440\n 441 if (!pdd->dev->kfd->shared_resources.enable_mes) {\n 442 r = debug_lock_and_unmap(pdd->dev->dqm);\n 443 if (r)\n 444 return r;\n 445 }\n 446\n 447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false);\n--> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch(\n 449 pdd->dev->adev,\n 450 watch_id);\n\nv2: (as per, Jonathan Kim)\n - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to\n match the clear path.\n - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id().","state":0,"publishedAt":"2026-05-27T12:16:49.108+00:00","modifiedAt":"2026-10-19T19:26:39.2+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/gpu/drm/amd/amdkfd/kfd_debug.c\"\n ],\n \"versions\": [\n {\n \"version\": \"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\n \"lessThan\": \"971bf8e61e9b4abaacf9b35eaf76ec222758f9d6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\n \"lessThan\": \"a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\n \"lessThan\": \"2b36c0c1bcbbe15f6cfa9652084b3124c835a150\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\n \"lessThan\": \"3c38a0f07aa2bfef2b219b1f045534ad93f85afd\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"e0f85f4690d089cc1a60337decafb1acf7eec45e\",\n \"lessThan\": \"5a19302cab5cec7ae7f1a60c619951e6c17d8742\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/gpu/drm/amd/amdkfd/kfd_debug.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.5\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.128\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.75\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.14\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.19.4\",\n \"lessThanOrEqual\": \"6.19.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.0\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/971bf8e61e9b4abaacf9b35eaf76ec222758f9d6","https://git.kernel.org/stable/c/a0d367e13db63a6ed76ee0d0a8c3a58c1fa98488","https://git.kernel.org/stable/c/2b36c0c1bcbbe15f6cfa9652084b3124c835a150","https://git.kernel.org/stable/c/3c38a0f07aa2bfef2b219b1f045534ad93f85afd","https://git.kernel.org/stable/c/5a19302cab5cec7ae7f1a60c619951e6c17d8742"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45878","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45878","identifiers":["CVE-2026-45878"]},"retained":false,"historicalAffected":[]}],"coverage":[]}