CVE-2026-53374

What it is

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a single PTE is written the TLB may speculatively load other uninitialized entries from the same cacheline. Those garbage entries can appear valid, and a subsequent write to another PTE in the same cacheline may cause the GPU to use a stale garbage PTE from the TLB. Fix this by calling memset_io() to zero-initialize the GART table with gart_pte_flags immediately after allocation. Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work since SDMA needs GART to be initialized to work. (cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-19 11:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-19 20:19 UTC Last updatedMost recent change to the record

Details

Published

2026-07-19 11:16 UTC

Last modified

2026-10-19 20:19 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-457

Record status

Modified

Affected

• Linux Kernel < 6.1.175
• Linux Kernel < 6.6.140
• Linux Kernel < 6.12.90
• Linux Kernel < 6.18.32
• Linux Kernel < 7.0.9
• Linux Kernel 7.1

Attack profile CVSS 3.1 · 8.8

Attack vector

Local

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High