{"id":"CVE-2026-63881","revision":"d7587ba15ee44d6ab8957cc4f43a1f3d","records":[{"revision":"d7587ba15ee44d6ab8957cc4f43a1f3d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63881","aliases":[],"title":"drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n\nget_queue_ids() computes array_size = num_queues * sizeof(uint32_t),\nwhich could overflow on 32-bit size_t build. using array_size()\ninstead, it saturates to SIZE_MAX on overflow.\n\n(cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285)","state":0,"publishedAt":"2026-07-19T14:54:53.676+00:00","modifiedAt":"2026-10-19T20:17:54.018+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a70a93fa568b4f05aba548dadb673703eccf5480\",\n                            \"lessThan\": \"4e5f808b454167cc58d7084a407a554d8ddc694d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a70a93fa568b4f05aba548dadb673703eccf5480\",\n                            \"lessThan\": \"de70a80992396ee306ee3a2810ad28aa1608ba9b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a70a93fa568b4f05aba548dadb673703eccf5480\",\n                            \"lessThan\": \"5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a70a93fa568b4f05aba548dadb673703eccf5480\",\n                            \"lessThan\": \"4f9eeedc3d3151f8a226fd676c314a813edda5a1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a70a93fa568b4f05aba548dadb673703eccf5480\",\n                            \"lessThan\": \"93f5534b35a05ef8a0109c1eefa800062fee810a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.5\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.93\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.35\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.12\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/4e5f808b454167cc58d7084a407a554d8ddc694d","https://git.kernel.org/stable/c/de70a80992396ee306ee3a2810ad28aa1608ba9b","https://git.kernel.org/stable/c/5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c","https://git.kernel.org/stable/c/4f9eeedc3d3151f8a226fd676c314a813edda5a1","https://git.kernel.org/stable/c/93f5534b35a05ef8a0109c1eefa800062fee810a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63881","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63881","identifiers":["CVE-2026-63881"]},"retained":false,"historicalAffected":[]}],"coverage":[]}