CVE-2026-53376

A flaw was found in the AMD Kernel Fusion Driver (AMDKFD) in the Linux kernel. This vulnerability exists in the kfd_ioctl_get_process_apertures_new function, where a missing upper bound check for the num_of_nodes argument could allow a local attacker to provide an excessively large value. This could lead to an out-of-bounds read or write, potentially resulting in information disclosure or a denial of service to the system.

A missing upper bound check in the AMD KFD process aperture ioctl allowed a local caller to pass a num_of_nodes value larger than the actual number of KFD topology devices. The affected path is kfd_ioctl_get_process_apertures_new() and the input is processed while filling process aperture information for GPU nodes. For the CVSS the PR:L is used because reliable triggering requires local access to the KFD device interface such as /dev/kfd, usually granted to users or services with GPU compute access rather than to a remote network attacker. The issue is not network reachable and is triggered through a local device ioctl. Impact is primarily denial of service or incorrect ioctl behavior. There is no strong evidence in the provided diff for a UAF, OOB write, information leak, or privilege escalation primitive, so confidentiality and integrity are kept at N for both base and paranoid scoring.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.