CVE-2026-68447

This CVE exposes a fundamental trust failure in AMD's GPU compute driver (amdkfd). The vulnerability isn't merely a memcpy over-read — it's a pattern where hardware-reported size values are used directly to govern kernel-to-userspace data transfers, with no validation against the driver's own allocation boundaries. When a CRIU checkpoint is triggered on a GPU compute process, the kernel reads `cp_hqd_cntl_stack_size` directly from GPU hardware and uses that value to determine how many bytes to copy from the queue control stack into the checkpoint. The hardware field exists for firmware coordination, not security enforcement. The kernel treats it as authoritative, and the copy destination is a userspace-accessible checkpoint file — meaning an unprivileged user can trigger this operation on their own compute workloads. The data leakage scope matters critically. The copy reads from GTT (Graphics Translation Table) memory — system RAM used as a staging buffer for GPU operations. GTT pages are often adjacent to other allocations. The leaked contents aren't limited to driver internals; they include whatever occupies neighboring GTT pages, potentially including data from other processes or earlier kernel operations. In cloud GPU environments where this driver is heavily deployed, adjacent pages may contain another tenant's workload data. CRIU transforms this from a transient kernel bug into a persistent exfiltration tool. The leaked data doesn't vanish — it's written to a checkpoint file that survives process exit and persists on disk. An attacker doesn't need timing precision; they can trigger a checkpoint, wait, and selectively retrieve the artifact. Administrators running GPU compute workloads may have checkpoint files already stored from before this patch was applied. The fix clamps the hardware-reported size to `ctl_stack_size`, but that value is allocated by and controllable from userspace. This trades an unpredictable leak for a bounded but user-controlled exfiltration window. More importantly, the systemic pattern remains unaddressed: other hardware-derived sizes in amdkfd and competing GPU drivers likely govern userspace-accessible operations without similar bounds enforcement. Every new CRIU integration creates fresh trust transfer surface area. Prioritize: audit other amdkfd paths where hardware-reported sizes govern userspace-accessible operations, review CRIU's privilege model to confirm checkpoint triggers require appropriate isolation, and treat existing GPU compute checkpoint files as potentially contaminated artifacts.

Reviewed through automated stages and approved by a human before publication.