CVE-2024-26817
amdkfd: use calloc instead of kzalloc to avoid integer overflow
MEDIUM
5.5
CVSS Score
Published: April 13, 2024 at 11:17 AM UTC
Updated: June 17, 2026 at 07:18 AM UTC
2 products affected across 2 vendorsLinux KernelDebian Linux
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.8%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Debian Linux· Debiandrupal
95%v < 4.19.3123.19 ≤ v < 4.19.3123.19 ≤ v < 5.10.2153.19 ≤ v < 5.15.1553.19 ≤ v < 5.4.2743.19 ≤ v < 6.1.863.19 ≤ v < 6.6.273.19 ≤ v < 6.8.63.19 ≤ v < 6.94.20 ≤ v < 5.4.2745.11 ≤ v < 5.15.1555.16 ≤ v < 6.1.865.5 ≤ v < 5.10.2156.2 ≤ v < 6.6.276.7 ≤ v < 6.8.64a488a7ad71401169cecee75dc94bcce642e2c536.9 rc16.9 rc26.9 rc3
Vendor states this is fixed in 0c33d11153949310d76631d8f4a4736519eacd3a (fixed)
Vendor states this is fixed in 315eb3c2df7e4cb18e3eacfa18a53a46f2bf0ef7 (fixed)
Vendor states this is fixed in 3b0daecfeac0103aba8b293df07a0cbaf8b43f29 (fixed)
Vendor states this is fixed in 8b0564704255c6b3c6a7188e86939f754e1577c0 (fixed)
Vendor states this is fixed in cbac7de1d9901521e78cdc34e15451df3611f2ad (fixed)
Vendor states this is fixed in e6721ea845fcb93a764a92bd40f1afc0d6c69751 (fixed)
Vendor states this is fixed in e6768c6737f4c02cba193a3339f0cc2907f0b86a (fixed)
Vendor states this is fixed in fcbd99b3c73309107e3be71f20dff9414df64f91 (fixed)
Vendor states this is fixed in 3.19 (unaffected)
Vendor states this is fixed in 4.19.312 (unaffected)
Vendor states this is fixed in 5.10.215 (unaffected)
Vendor states this is fixed in 5.15.155 (unaffected)
Vendor states this is fixed in 5.4.274 (unaffected)
Vendor states this is fixed in 6.1.86 (unaffected)
Vendor states this is fixed in 6.6.27 (unaffected)
Vendor states this is fixed in 6.8.6 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/0c33d11153949310d76631d8f4a4736519eacd3a
- https://git.kernel.org/stable/c/315eb3c2df7e4cb18e3eacfa18a53a46f2bf0ef7
- https://git.kernel.org/stable/c/3b0daecfeac0103aba8b293df07a0cbaf8b43f29
- https://git.kernel.org/stable/c/8b0564704255c6b3c6a7188e86939f754e1577c0
- https://git.kernel.org/stable/c/cbac7de1d9901521e78cdc34e15451df3611f2ad
References (11)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0c33d11153949310d76631d8f4a4736519eacd3aPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/315eb3c2df7e4cb18e3eacfa18a53a46f2bf0ef7Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3b0daecfeac0103aba8b293df07a0cbaf8b43f29Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8b0564704255c6b3c6a7188e86939f754e1577c0Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cbac7de1d9901521e78cdc34e15451df3611f2adPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e6721ea845fcb93a764a92bd40f1afc0d6c69751Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e6768c6737f4c02cba193a3339f0cc2907f0b86aPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fcbd99b3c73309107e3be71f20dff9414df64f91SSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-190
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card