drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

{
  "id": "4cba3902733fdb09946d33c6ad4078633d0542f157567faea9fcedecbedb1b44",
  "url": "https://osv.dev/vulnerability/CVE-2026-53143",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow. During CRIU checkpoint of an SDMA queue on Navi3x: - checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer, leaking 1536 bytes of adjacent GTT memory to userspace During CRIU restore: - restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer, corrupting 1536 bytes of adjacent GTT memory (often the ring buffer or neighboring MQDs) This is a copy-paste regression unique to v11. All other ASIC backends (cik, vi, v9, v10, v12) correctly use the SDMA-specific variants. Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly handle the smaller v11_sdma_mqd structure, matching the pattern used in other MQD managers. (cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)",
    "evidence": "osv:CVE-2026-53143",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.6.143",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.94",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.36",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.13",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-53143",
      "aliases": [
        "CVE-2026-53143"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "cc009e613de6560eb499f8bc92c80a737752cb30"
                },
                {
                  "fixed": "16dad1fb0d783a4008de30e32d0038c393de05b1"
                },
                {
                  "fixed": "2c5b66c9b4057b385566940935ebc32f6e6ebfd2"
                },
                {
                  "fixed": "d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64"
                },
                {
                  "fixed": "d02f05d30f35b036f7cbaf72de634affb5b38ec6"
                },
                {
                  "fixed": "352ea59028ea48a6fff77f19ae28f98f71946a80"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53143.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.19.0"
                },
                {
                  "fixed": "6.6.143"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.94"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.36"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.0.13"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53143.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:22.443235224Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1",
        "https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2",
        "https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80",
        "https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6",
        "https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53143.json",
        "https://access.redhat.com/errata/RHSA-2026:57251",
        "https://access.redhat.com/errata/RHSA-2026:57252",
        "https://access.redhat.com/security/cve/CVE-2026-53143",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53143.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53143",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2492719",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53143.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53143",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 488505,
  "published_at": "2026-06-25T08:38:30.901+00:00"
}