The Linux kernel amdgpu driver had a vulnerability (CVE-2026-74357) involving a slab-out-of-bounds write in the amdgpu_coredump ring dump function. Two loops iterate over adev->rings[]: the first counts rings with unsignalled fences to size the allocation, and the second copies ring data into the allocated buffer. Both loops use the same condition to skip rings, but because the fence signaling state can change concurrently, the second loop may see more unsignalled rings than counted, causing the index to exceed the allocated ring_count. This leads to writing beyond the allocated buffer, triggering a KASAN slab-out-of-bounds error. The issue was discovered during IGT stress tests that provoke GPU resets and ring timeouts. The fix adds an index boundary check in the copy loop to ensure it does not exceed the allocated ring_count, preventing the out-of-bounds write.

This vulnerability causes a slab-out-of-bounds write in kernel memory during GPU reset handling, which can lead to memory corruption and potential kernel instability or crashes. The flaw is non-deterministic and depends on timing of fence signaling during GPU resets. There is no evidence of active exploitation in the wild. The impact is primarily on system stability and reliability rather than direct privilege escalation or code execution.

A fix has been implemented that adds a boundary check to prevent out-of-bounds writes in the amdgpu_coredump ring dump code. Users should update to a Linux kernel version that includes this patch once it is released. Since this is a kernel-level issue, applying the official kernel update or vendor-provided patch is the recommended remediation. Patch status is not yet confirmed in the provided data; users should consult the official Linux kernel or distribution vendor advisories for the current remediation status.