CVE-2026-80747 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add bounds check for CRAT subtype length
The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures.
Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents.
(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel's Direct Rendering Manager subsystem, specifically the AMD Kernel Fusion Driver component responsible for managing heterogeneous computing resources on AMD hardware, contained a critical input validation flaw within its Common Redundancy Check Architecture Table parser. This table is part of the ACPI specification and provides system firmware with information about processor topology, memory attributes, and other platform-specific details required by the operating system to optimize performance and resource allocation. The vulnerability arises from an incomplete boundary check during the parsing process where the driver validates that the initial subtype header structure resides within the allocated buffer but fails to verify that the length field specified in that header does not extend beyond the end of the available data. This oversight creates a scenario where malformed or maliciously crafted ACPI tables can trigger out-of-bounds memory reads when the kernel attempts to interpret the contents of these subtypes as specific structured data types.
From a technical perspective, the flaw is located within the kfd_parse_subtype function which processes various subsections of the CRAT table. When the parser encounters a subtype entry it does not immediately recognize or needs further inspection, it casts the raw header bytes into predefined C structures to extract detailed information. Because the code did not ensure that the sum of the pointer offset and the advertised length remained within the bounds of the mapped ACPI memory region, an oversized length value allows the cast operation and subsequent access patterns to read memory locations outside the intended buffer. This constitutes a classic out-of-bounds read vulnerability where the kernel accesses physical or virtual memory addresses it should not be permitted to touch based on the declared size of the data structure.
The operational impact of this vulnerability is primarily related to system stability and potential information disclosure rather than direct code execution, although the severity can escalate depending on what lies in the adjacent memory space. An out-of-bounds read typically results in kernel panics or system crashes due to invalid memory access violations when the driver attempts to process garbage data retrieved from outside the buffer boundaries. In more sophisticated attack scenarios where an attacker has control over the ACPI tables, such as through physical access or compromised firmware update mechanisms, this flaw could potentially be leveraged to leak sensitive kernel memory contents into user space if those values are subsequently returned via sysfs interfaces or other debugging endpoints exposed by the driver. This aligns with CWE-125 which describes out-of-bounds read vulnerabilities that allow attackers to bypass intended access restrictions and view restricted information.
This vulnerability is categorized under ATT&CK technique T1608, specifically related to weaponized files or data manipulation within system firmware components, as it involves exploiting the parsing logic of a critical platform configuration table. The lack of strict length validation represents a common class of errors in low-level systems programming where developers assume that header presence implies valid content size. Mitigation for this issue requires applying the upstream kernel patch which introduces explicit bounds checking before any subtype-specific processing occurs. System administrators should ensure their Linux kernels are updated to versions containing commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d or later, which adds the necessary validation logic to verify that sub_type_hdr plus length does not exceed the image boundary. Additionally, organizations relying on AMD hardware for heterogeneous computing workloads should monitor vendor security advisories for any further updates related to ACPI table parsing in future kernel releases to maintain robust defense against malformed input attacks targeting system initialization routines.