CVE-2026-93823

A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). A local user with access to the GPU device interface can trigger excessive kernel memory allocation by providing an abnormally large buffer size parameter during an input/output control (ioctl) request. This issue can exhaust system memory and trigger an out-of-memory condition, leading to a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's AMD GPU KFD driver (drm/amdkfd) as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 based nodes of OpenShift Container Platform 4.13 and later. In the AMDKFD_IOC_GET_DMABUF_INFO ioctl handler, the amdkfd driver allocated kernel memory for returning buffer-object metadata based on a user-supplied buffer size without validating it against the actual metadata size. A local user with access to the AMD GPU/KFD device, such as a member of the render group, could supply an abnormally large size (for example 2 GiB) and thereby trigger excessive high-order kernel allocations, exhaust system memory, and cause an out-of-memory condition resulting in a denial of service. No impact to confidentiality or integrity is possible. The kernels of Red Hat Enterprise Linux 7 and 8 and the RHEL CoreOS 8 based nodes of OpenShift Container Platform 4.12 are not affected because the vulnerable code is not present in those versions. Because the issue requires local access to the GPU device and is limited to availability, fixes for the affected streams are currently deferred to a future update; the residual risk is a local denial of service on systems where untrusted users have access to AMD GPU compute devices. Red Hat rates this flaw as low impact due to the restricted local attack path, which is lower than what the CVSS 3.1 base score of 5.5 (moderate) alone would suggest.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can be mitigated by restricting access to the AMD KFD and GPU render device nodes so that only trusted local users can reach them: remove untrusted users from the render (and, where applicable, video) group, for example with 'gpasswd -d <user> render', or otherwise limit permissions on /dev/kfd and the DRM render nodes. The complete fix, which makes the driver rather than userspace decide the buffer allocation size in the AMDKFD_IOC_GET_DMABUF_INFO ioctl, is deferred and will be delivered in a future kernel update for the affected streams.