CVE-2026-68257

This is a kernel buffer overflow with a twist: the kernel isn't the one doing the overflowing. In amdkfd's queue buffer management, a u32 multiplication of compute unit count (XCC) times per-XCC buffer size can overflow, producing a wrapped (undersized) value. The kernel allocates a buffer based on this wrong size, then hands it to AMD GPU firmware along with the actual (unwrapped) size computation. The firmware, operating on its own memory semantics, writes based on what it thinks is a larger buffer — and overruns the kernel's undersized allocation by a wide margin. The kernel's usual defenses — hardened usercopy, bounds checking, overflow helpers — are completely blind to this because the corruption happens before allocation. The wrong size was always in play; there's no boundary crossing to catch. This creates a protocol mismatch: the kernel computes a size, firmware acts on it, and an integer overflow in the kernel's math becomes an uncontrolled firmware write into adjacent memory. Check what sits beyond these queue buffers. The blast radius depends entirely on what firmware overwrites when it overruns — SVM mapping structures (cross-process data leak), GPU doorbell registers (command submission hijack), or firmware-internal structures. The kernel cannot instrument firmware memory writes, cannot see the violation occur, and cannot retroactively correct firmware behavior. The fix (promoting to u64 plus overflow checks) is standard, but the vulnerability was latent for years on single-XCC GPUs where the multiplication could never overflow. It only becomes triggerable on multi-chip modules with high XCC counts — systems that likely weren't in typical test matrices. The EPSS score is low not because the bug is minor, but because exploitation requires specific hardware topology and the firmware behavior under overrun remains opaque. If you're defending AMD GPU systems, prioritize kernel updates, but treat this as a reminder that firmware-side trust boundaries don't respect kernel memory protection — and that adjacent memory layout on these devices may determine whether a patch is sufficient or merely reduces the blast radius.

Reviewed through automated stages and approved by a human before publication.