CVE-2026-46229

MEDIUM EPSS 2.0%
Published May 28, 20261mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published May 28, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated VRAM with stale data from prior use observable by compute kernels. The GEM ioctl path already sets VRAM_CLEARED for all userspace allocations via amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). The KFD path was missing this flag, allowing stale page table remnants to leak into user buffers. This causes crashes in RCCL P2P transport where non-zero data in ptrExchange/head/tail fields corrupts the protocol handshake.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
2.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel*≥5.4  –  <6.6.140
linuxlinux_kernel*≥6.7  –  <6.12.90
linuxlinux_kernel*≥6.13  –  <6.18.32
linuxlinux_kernel*≥6.19  –  <7.0.9

References 5

  • git.kernel.org https://git.kernel.org/stable/c/047d44d8d29a6a1a5757256837aa9dd78e3cd0b5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1db431380879fd9d28b763a88a0c0431be5be8df
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/32b153658f017ad2f5bf8aab479e8d16ac95bc3a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/77d0b5d11387071770246fd0185a69fa28e8e109
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ad52d61d82181dbdb7f05826de38352d5e550cc2
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/047d44d8d29a6a1a5757256837aa9dd78e3cd0b5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1db431380879fd9d28b763a88a0c0431be5be8df
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/32b153658f017ad2f5bf8aab479e8d16ac95bc3a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/77d0b5d11387071770246fd0185a69fa28e8e109
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ad52d61d82181dbdb7f05826de38352d5e550cc2
    Patch