CVE-2026-68259

A flaw was found in the Linux kernel. A missing bounds check in the allocate_event_notification_slot function within the drm/amdkfd component allows a local attacker to provide an out-of-bounds event ID. This could lead to memory corruption, potentially resulting in a denial of service or privilege escalation.

This vulnerability is rated Moderate severity because exploitation requires local access on systems equipped with AMD graphics compute hardware, limiting exposure to authenticated users rather than remote attackers. The issue arises from improper boundary verification during the allocation of compute event notification slots, which could allow a local attacker to cause kernel memory corruption and a denial of service. Deployments without AMD GPU hardware or environments where AMD compute drivers are not loaded remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.