CVE-2026-53143 — CVE & Security Advisory Radar

🎯 CVE-2026-53143 HIGH 7.0 🔥 EPSS 14% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-53143 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow. During CRIU checkpoint of an SDMA queue on Navi

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

The v11 MQD manager incorrectly assigned the CP-compute variants of
checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions
use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct
v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.

During CRIU checkpoint of an SDMA queue on Navi3x:
- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,
leaking 1536 bytes of adjacent GTT memory to userspace

During CRIU restore:
- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,
corrupting 1536 bytes of adjacent GTT memory (often the ring buffer
or neighboring MQDs)

This is a copy-paste regression unique to v11. All other ASIC backends
(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.

Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly
handle the smaller v11_sdma_mqd structure, matching the pattern used in
other MQD managers.

(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)

Klassifikation & Betroffenheit:

Linux Linux patch: 6.6.143Linux cc009e613de6560eb499f8bc92c80a737752cb30 <2c5b66c9b4057b385566940935ebc32f6e6ebfd2Linux patch: 7.1Linux cc009e613de6560eb499f8bc92c80a737752cb30 <d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64Linux cc009e613de6560eb499f8bc92c80a737752cb30 <352ea59028ea48a6fff77f19ae28f98f71946a80Linux patch: 0Linux 5.19Linux cc009e613de6560eb499f8bc92c80a737752cb30 <16dad1fb0d783a4008de30e32d0038c393de05b1

Improper Restriction of Operations within the Bounds of a Memory Buffer 🎯 High

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

🛡️ Empfohlene Mitigation: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow prot…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-10 · Buffer Overflow via Environment Variable… (High) CAPEC-14 · Client-side Injection-induced Buffer Ove… (High) CAPEC-24 · Filter Failure through Buffer Overflow (High) CAPEC-42 · MIME Conversion (High) CAPEC-44 · Overflow Binary Resource File (Very High) CAPEC-45 · Buffer Overflow via Symbolic Links (High) CAPEC-100 · Overflow Buffers (Very High) CAPEC-123 · Buffer Manipulation (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-74497 8.4 CVE-2026-74492 8.4 CVE-2026-74461 8.4 CVE-2026-74383 8.4 CVE-2026-74333 8.4

🩹 Patch verfügbar (OSV):

🩹 Kernel ≥ 6.6.143 🩹 Kernel ≥ 6.12.94 🩹 Kernel ≥ 6.18.36 🩹 Kernel ≥ 7.0.13

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 06/2026

Heute 09.09.

CVSS-Vektor-Analyse: 7.0

AV · Angriffsvektor Lokal

AC · Komplexität Hoch

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:25.06.2026

Aktualisiert:20.08.2026 13:19

Assigner (CNA):Linux

EUVD-ID:EUVD-2026-39234

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-119: Memory Corruption ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

Tier	2026-08-29	2026-09-06
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

7.0 HIGH

🇪🇺 EUVD

EPSS

14%

CVE-2026-53143 💻 Lokal 🔑 Geringe Nutzerrechte nötig

Linux

CVE-2026-53143 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow. During CRIU checkpoint of an SDMA queue on Navi

CWE-119: Memory Corruption ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

25.06.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub