CVE-2026-74357

A flaw was found in the drm/amdgpu component of the Linux kernel. This vulnerability involves a race condition during the processing of GPU ring data within the amdgpu_coredump function. This can lead to a memory corruption issue, specifically a slab-out-of-bounds write. A local attacker could potentially exploit this flaw to cause system instability or a denial of service (DoS).

A MODERATE severity flaw was found in the drm/amdgpu driver of the Linux kernel. The amdgpu_coredump() function, which runs in the GPU reset and job-timeout error path, makes two passes over the device's ring array: the first counts rings with unsignalled fences to size a kcalloc allocation, and the second copies ring data into the allocated buffers. Because the fence signalling path updates ring state concurrently, more rings can appear unsignalled in the second pass than were counted in the first, and the copy index can then exceed the allocated count, storing a 4-byte ring index past the end of the buffer (a KASAN-detected slab-out-of-bounds write). A local attacker with access to the AMDGPU device who can provoke a GPU reset could exploit this race to corrupt adjacent kernel memory and crash the system, causing a denial of service; triggering is non-deterministic and depends on fence-signalling timing during the reset.

Red Hat rated this flaw MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the established impact is a local denial of service: the overflow is a small, bounded write of a ring index in an error-handling code path, and no path to loss of confidentiality or integrity has been demonstrated. The upstream CVE record assigns a higher CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which assumes a generic full compromise of confidentiality, integrity, and availability from the out-of-bounds write.

No Red Hat product is currently listed as affected. All Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS kernel streams on this record are marked NOTAFFECTED because the vulnerable code is not present in those shipped kernels, and the remaining Red Hat Enterprise Linux 6 ELS stream is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.