CVE-2026-74447
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t…
- Risk score
- 62/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 15 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses…
- Affected
- Canonical Ubuntu Linux
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-74447: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t… (CVSS 7.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 96 in the last 90 days
Why it is Amber
- CVSS 7.8 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8959-1
- https://ubuntu.com/security/notices/USN-8960-1
- https://git.kernel.org/stable/c/273548eb997c6be85230c1236b18784b09f6203c
- https://git.kernel.org/stable/c/6dc0b4b39ed4f11ef70f76ecea8537e35f45342b
- https://git.kernel.org/stable/c/7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961
- https://git.kernel.org/stable/c/83463a96ea3c7d8ae636a4d6a0ba63c9ce410724
Original description
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to 0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB BO, so CP EOP writes can land past the buffer and fault the GPU. Cast the operand to u64 so the alignment is computed in 64-bit; the size check in kfd_queue_buffer_get() then rejects the oversized request. (cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)
Last activity 3 Nov 2026. Patch Forecast updates every hour.