CVE-2026-43598

Name	CVE-2026-43598
Description	Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150290

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rccl (PTS)	sid, trixie	5.4.3-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rccl	source	(unstable)	(unfixed)			1150290

Notes

[trixie] - rccl <no-dsa> (Minor issue)
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6033.html
Fixed by: https://github.com/ROCm/rocm-systems/commit/ccba298bcfb644246e07b1137e948a4cab60eb29 (therock-7.14)