CVE-2026-45853 Details
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() amdgpu_discovery_get_nps_info() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption. Use kvfree() to safely handle both kmalloc and vmalloc allocations. Compile tested only. Issue found using a prototype static analysis tool and code review.
A memory management vulnerability has been identified in the Linux kernel's AMD GPU driver. The issue arises in the 'amdgpu_gmc_get_nps_memranges()' function, which allocates memory using 'kvcalloc()'. This allocation method can lead to memory corruption if 'kfree()' is used to release memory allocated by 'vmalloc()', particularly for large allocations. The vulnerability has been addressed by changing the deallocation method to 'kvfree()', which correctly handles memory allocated by both 'kmalloc' and 'vmalloc'. This issue was discovered through static analysis and code review.
Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0c44d61945c4a80775292d96460aa2f22e62f86c | kernel.org | Patch |
| https://git.kernel.org/stable/c/16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e | kernel.org | Patch |
| https://git.kernel.org/stable/c/9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f441538893eba6347b983f2904819ca6c99da65e | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.11, < 6.12.75 >= 6.13, < 6.18.14 >= 6.19, < 6.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |