CVE-2026-43206

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= 0fc8011f89feb8b2c3008583b777d097e1974660, < 3e04bc310d80b46eaf481f1fefcbcb37a187412d; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < b4034442cb090e4a980bdcc1540948606cbc951b; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < 75fb57efdd7863fffbc39db23e9cad7aafda26ed; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < 4e72f419e4ed44cb3b60506752d8688c20a60a9b; >= 0fc8011f89feb8b2c3008583b777d097e1974660, < 8a70a26c9f34baea6c3199a9862ddaff4554a96d
LinuxLinux4.17

References

Timeline

Published
May 6, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-432077.8In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: Fix error handling in probe function Add mtk_mdp_unregCVE-2026-432089.8In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumCVE-2026-432095.5In the Linux kernel, the following vulnerability has been resolved: minix: Add required sanity checking to minix_check_superblock() The fsCVE-2026-43219.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital CVE-2026-432105.5In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check theCVE-2026-432117.8In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: CVE-2026-432127.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE The archCVE-2026-432137.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report HardwaCVE-2026-432147.8In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() AddCVE-2026-432158.8In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_seCVE-2026-432165.5In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp() maCVE-2026-432175.5In the Linux kernel, the following vulnerability has been resolved: media: iris: gen2: Add sanity check for session stop In iris_kill_sess