CVE-2026-98176

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98176", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.322Z", "datePublished": "2026-10-06T08:44:20.004Z", "dateUpdated": "2026-11-10T18:15:10.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:10.994Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\n\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)\n\nusing properties of logarithms.\n\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"], "versions": [{"version": "14328aa58ce523a59996c5a82681c43ec048cc33", "lessThan": "1ab281c7ce2dc5195d337f2c16e22eba356b47f9", "status": "affected", "versionType": "git"}, {"version": "14328aa58ce523a59996c5a82681c43ec048cc33", "lessThan": "9e8f43579f849fba0dd1059160f50bd44a767366", "status": "affected", "versionType": "git"}, {"version": "14328aa58ce523a59996c5a82681c43ec048cc33", "lessThan": "82e1b8299c6da02ce02185c208d2fdf7572b5ea1", "status": "affected", "versionType": "git"}, {"version": "14328aa58ce523a59996c5a82681c43ec048cc33", "lessThan": "c883d0a132d430ef7ebb23fd94323be94d0fbdb8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1ab281c7ce2dc5195d337f2c16e22eba356b47f9"}, {"url": "https://git.kernel.org/stable/c/9e8f43579f849fba0dd1059160f50bd44a767366"}, {"url": "https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1"}, {"url": "https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}], "title": "drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1ab281c7ce2dc5195d337f2c16e22eba356b47f9", "status": "affected", "version": "14328aa58ce523a59996c5a82681c43ec048cc33", "versionType": "git"}, {"lessThan": "9e8f43579f849fba0dd1059160f50bd44a767366", "status": "affected", "version": "14328aa58ce523a59996c5a82681c43ec048cc33", "versionType": "git"}, {"lessThan": "82e1b8299c6da02ce02185c208d2fdf7572b5ea1", "status": "affected", "version": "14328aa58ce523a59996c5a82681c43ec048cc33", "versionType": "git"}, {"lessThan": "c883d0a132d430ef7ebb23fd94323be94d0fbdb8", "status": "affected", "version": "14328aa58ce523a59996c5a82681c43ec048cc33", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\n\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)\n\nusing properties of logarithms.\n\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)"}], "id": "CVE-2026-98176", "lastModified": "2026-11-10T19:22:23.880", "metrics": {}, "published": "2026-10-06T09:17:59.653", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ab281c7ce2dc5195d337f2c16e22eba356b47f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e8f43579f849fba0dd1059160f50bd44a767366"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc", "id": "2546467", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546467"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\nffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\nChange this to\nffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)\nusing properties of logarithms.\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)", "A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). An integer underflow vulnerability during the calculation of the End of Pipe (EOP) ring buffer size can lead to improper hardware queue configuration. A local user could potentially exploit this issue to cause system instability, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98176", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98176\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98176\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98176.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,82e1b8299c6da02ce02185c208d2fdf7572b5ea1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c883d0a132d430ef7ebb23fd94323be94d0fbdb8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:15:17.607821+00:00", "updated": "2026-10-09T03:15:15.735593+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}