CVE-2026-98176

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as ffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1 But ffs can in theory return 1 or 0, so this could underflow (although in practice the ring buffer size cannot be less than 4096). Change this to ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4) using properties of logarithms. (cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-06 09:17:59.653000

Last modified

2026-10-19 10:18:17.983000

View original CVE JSON

{
  "id": "CVE-2026-98176",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-06T09:17:59.653",
  "lastModified": "2026-10-19T10:18:17.983",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\n\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)\n\nusing properties of logarithms.\n\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "14328aa58ce523a59996c5a82681c43ec048cc33",
              "lessThan": "82e1b8299c6da02ce02185c208d2fdf7572b5ea1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "14328aa58ce523a59996c5a82681c43ec048cc33",
              "lessThan": "c883d0a132d430ef7ebb23fd94323be94d0fbdb8",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.3",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.8",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}