CVE-2026-98177

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98177", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.322Z", "datePublished": "2026-10-06T08:44:20.807Z", "dateUpdated": "2026-11-10T18:15:11.582Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:11.582Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow in EOP ring size calculation.\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\norder_base_2(q->eop_ring_buffer_size / 4) - 1\n\nBut order_base_2 can in theory return 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\norder_base_2(q->eop_ring_buffer_size / 8)\n\nusing properties of logarithms.\n\nAlso add to the above comment to make the mathematics more clear.\n\n(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c"], "versions": [{"version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "lessThan": "85f2d80a260f2ee90647da094b80a2d5ce719750", "status": "affected", "versionType": "git"}, {"version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "lessThan": "3c97f7cb6c48826663648b6081b614c2befc8ac7", "status": "affected", "versionType": "git"}, {"version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "lessThan": "287a34c4d712e0bdb67751e21316d9c8d75a528a", "status": "affected", "versionType": "git"}, {"version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "lessThan": "8ee521b8b189799e361d4233c5180ba56656d4d4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/85f2d80a260f2ee90647da094b80a2d5ce719750"}, {"url": "https://git.kernel.org/stable/c/3c97f7cb6c48826663648b6081b614c2befc8ac7"}, {"url": "https://git.kernel.org/stable/c/287a34c4d712e0bdb67751e21316d9c8d75a528a"}, {"url": "https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}], "title": "drm/amdkfd: Avoid integer underflow in EOP ring size calculation.", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "85f2d80a260f2ee90647da094b80a2d5ce719750", "status": "affected", "version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "versionType": "git"}, {"lessThan": "3c97f7cb6c48826663648b6081b614c2befc8ac7", "status": "affected", "version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "versionType": "git"}, {"lessThan": "287a34c4d712e0bdb67751e21316d9c8d75a528a", "status": "affected", "version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "versionType": "git"}, {"lessThan": "8ee521b8b189799e361d4233c5180ba56656d4d4", "status": "affected", "version": "d696d536f0a97ac779d6176107ac4e96d0a2f8b9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow in EOP ring size calculation.\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\norder_base_2(q->eop_ring_buffer_size / 4) - 1\n\nBut order_base_2 can in theory return 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\norder_base_2(q->eop_ring_buffer_size / 8)\n\nusing properties of logarithms.\n\nAlso add to the above comment to make the mathematics more clear.\n\n(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)"}], "id": "CVE-2026-98177", "lastModified": "2026-11-10T19:22:24.010", "metrics": {}, "published": "2026-10-06T09:17:59.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/287a34c4d712e0bdb67751e21316d9c8d75a528a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c97f7cb6c48826663648b6081b614c2befc8ac7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/85f2d80a260f2ee90647da094b80a2d5ce719750"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdkfd: Avoid integer underflow in EOP ring size calculation", "id": "2546416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546416"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdkfd: Avoid integer underflow in EOP ring size calculation.\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\norder_base_2(q->eop_ring_buffer_size / 4) - 1\nBut order_base_2 can in theory return 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\nChange this to\norder_base_2(q->eop_ring_buffer_size / 8)\nusing properties of logarithms.\nAlso add to the above comment to make the mathematics more clear.\n(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)", "A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). A local user could trigger a Denial of Service (DoS) or system instability due to an integer underflow vulnerability during the calculation of the End of Pipe (EOP) ring buffer size. Under specific conditions, this improper calculation could lead to misconfigured hardware queue controls and unexpected driver behavior."], "name": "CVE-2026-98177", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98177\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98177\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98177.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,287a34c4d712e0bdb67751e21316d9c8d75a528a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8ee521b8b189799e361d4233c5180ba56656d4d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.2.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.8,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T11:45:17.781570+00:00", "updated": "2026-10-09T03:30:06.911595+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}