In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80747 is a bounds checking vulnerability in the Linux kernel's AMD KFD (Kernel Fusion Driver) CRAT table parser. The parser validates that subtype headers fit within the image boundaries but fails to verify that the advertised subtype length itself doesn't exceed those boundaries. This allows a malformed CRAT table with an oversized length field to trigger out-of-bounds memory reads when the parser casts headers to specific subtype structures. This vulnerability affects systems running vulnerable Linux kernel versions with AMD GPU support, particularly in data center and high-performance computing environments where KFD is actively used.
While this CVE lacks direct MITRE ATT&CK technique mapping and has zero matching Casky skills, practitioners using Casky's Claude-powered analysis would identify the underlying attack pattern as related to memory corruption and information disclosure. The vulnerability chain follows classic memory safety issues: insufficient input validation (T1566 - Phishing: Spearfishing Attachment or similar initial delivery of malformed firmware/tables) leading to out-of-bounds reads that could enable T1005 (Data from Local System) or T1040 (Traffic Capture). Practitioners would observe findings indicating missing bounds validation in parser logic, unchecked length fields from untrusted sources, and potential memory access violations—patterns Casky's extended reasoning would correlate with defense gaps in input sanitization and secure coding practices for kernel drivers handling firmware-supplied data structures.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80747. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation