CVE-2021-4460

EUVD-2025-32863

01.10.2025, 12:15

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.

Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 7%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	𝑥 < 5.4.118
linux	linux_kernel	5.5 ≤ 𝑥 < 5.10.36
linux	linux_kernel	5.11 ≤ 𝑥 < 5.11.20
linux	linux_kernel	5.12 ≤ 𝑥 < 5.12.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.148-1 fixed
bookworm (security)	6.1.153-1 fixed
bullseye	5.10.223-1 fixed
bullseye (security)	5.10.237-1 fixed
forky	6.16.8-1 fixed
sid	6.16.9-1 fixed
trixie	6.12.43-1 fixed
trixie (security)	6.12.48-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5

4.12.14-122.280.1

fixed

dlm-kmp-default

suse enterprise server 12 SP5

4.12.14-122.280.1

fixed

gfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.280.1

fixed

kernel-64kb

suse enterprise server 15 SP3

5.3.18-150300.59.221.1

fixed

kernel-default

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.221.1 fixed

kernel-default-base

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.221.1.150300.18.132.1 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.280.1

fixed

kernel-docs

suse enterprise server 15 SP3

5.3.18-150300.59.221.1

fixed

kernel-macros

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.221.1 fixed

kernel-obs-build

suse enterprise server 15 SP3

5.3.18-150300.59.221.1

fixed

kernel-preempt

suse enterprise server 15 SP3

5.3.18-150300.59.221.1

fixed

kernel-source

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.221.1 fixed

kernel-syms

suse enterprise server 12 SP5	4.12.14-122.280.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.221.1 fixed

kernel-zfcpdump

suse enterprise server 15 SP3

5.3.18-150300.59.221.1

fixed

ocfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.280.1

fixed

reiserfs-kmp-default

suse enterprise server 15 SP3

5.3.18-150300.59.221.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

bpftool

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-abi-stablelists

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-abi-whitelists

RHEL 8.2 AUS

0:4.18.0-193.193.1.el8_2

fixed

kernel-core

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-debug

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-debug-core

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-debug-devel

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-debug-modules

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-debug-modules-extra

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-devel

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-doc

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-modules

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-modules-extra

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-tools

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-tools-libs

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

kernel-tools-libs-devel

RHEL 8

0:4.18.0-372.9.1.el8

fixed

kernel-zfcpdump

RHEL 8

0:4.18.0-372.9.1.el8

fixed

kernel-zfcpdump-core

RHEL 8

0:4.18.0-372.9.1.el8

fixed

kernel-zfcpdump-devel

RHEL 8

0:4.18.0-372.9.1.el8

fixed

kernel-zfcpdump-modules

RHEL 8

0:4.18.0-372.9.1.el8

fixed

kernel-zfcpdump-modules-extra

RHEL 8

0:4.18.0-372.9.1.el8

fixed

perf

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

python3-perf

RHEL 8	0:4.18.0-372.9.1.el8 fixed
RHEL 8.2 AUS	0:4.18.0-193.193.1.el8_2 fixed
RHEL 8.4 AUS	0:4.18.0-305.188.1.el8_4 fixed

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://git.kernel.org/stable/c/0c0356ef2498c1a250fe3846f30293f828737309

https://git.kernel.org/stable/c/1874b0ef1426b873de94c61861e38f29a8df714c

https://git.kernel.org/stable/c/3fdc5182700910a685d23df57d65166e8556a266

https://git.kernel.org/stable/c/50e2fc36e72d4ad672032ebf646cecb48656efe0

https://git.kernel.org/stable/c/9069b1b542de8f3bbffef868aff41521b21485cf