Medium 5.5Published May 28, 2026

CVE-2026-46229drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure

Updated under an hour ago (Oct 26, 2026, 11:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated VRAM with stale data from prior use observable by compute kernels. The GEM ioctl path already sets VRAM_CLEARED for all userspace allocations via amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). The KFD path was missing this flag, allowing stale page table remnants to leak into user buffers. This causes crashes in RCCL P2P transport where non-zero data in ptrExchange/head/tail fields corrupts the protocol handshake.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	6856e4b65f64eeb3f17148f79b36c1d60c627529 builds before 1db431380879fd9d28b763a88a0c0431be5be8df; 6856e4b65f64eeb3f17148f79b36c1d60c627529 builds before 32b153658f017ad2f5bf8aab479e8d16ac95bc3a; 6856e4b65f64eeb3f17148f79b36c1d60c627529 builds before 77d0b5d11387071770246fd0185a69fa28e8e109; 6856e4b65f64eeb3f17148f79b36c1d60c627529 builds before 047d44d8d29a6a1a5757256837aa9dd78e3cd0b5; from 6856e4b65f64eeb3f17148f79b36c1d60c627529 before ad52d61d82181dbdb7f05826de38352d5e550cc2	CNA record
linux linux_kernel linux:linux_kernel	from 5.4 before 6.6.140; from 6.7 before 6.12.90; from 6.13 before 6.18.32; from 6.19 before 7.0.9	NVD

References

References

https://git.kernel.org/stable/c/1db431380879fd9d28b763a88a0c0431be5be8df	patch
https://git.kernel.org/stable/c/32b153658f017ad2f5bf8aab479e8d16ac95bc3a	patch
https://git.kernel.org/stable/c/77d0b5d11387071770246fd0185a69fa28e8e109	patch
https://git.kernel.org/stable/c/047d44d8d29a6a1a5757256837aa9dd78e3cd0b5	patch
https://git.kernel.org/stable/c/ad52d61d82181dbdb7f05826de38352d5e550cc2	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.