The Linux kernel's AMDGPU driver contained a vulnerability (CVE-2026-45853) due to incorrect memory deallocation in the amdgpu_gmc_get_nps_memranges() function. The function amdgpu_discovery_get_nps_info() allocates memory using kvcalloc(), which can allocate vmalloc memory for large sizes. The original code used kfree() to free this memory, which is unsafe for vmalloc memory and can lead to memory corruption. The fix replaces kfree() with kvfree(), which correctly handles both kmalloc and vmalloc allocated memory. This issue was found via static analysis and code review and affects the Linux kernel's AMDGPU driver. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Improper memory deallocation can lead to memory corruption, which may cause system instability, crashes, or potentially allow an attacker with local privileges to escalate privileges or cause denial of service. The CVSS score of 7.8 reflects a high impact on confidentiality, integrity, and availability, though exploitation requires local access and low privileges.

A fix has been implemented by replacing kfree() with kvfree() in the affected function to safely handle memory deallocation. Since this is a kernel vulnerability, users should apply the official Linux kernel updates or patches provided by their distribution to remediate this issue. No known exploits are reported in the wild. Patch status is not explicitly confirmed in the provided data; users should check their vendor or distribution advisories for the latest updates.