Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdgpu) that could allow a local user to compromise system stability or integrity. The issue stems from a failure to properly verify memory addresses provided by user applications when creating graphics queues. An attacker could potentially exploit this to access or modify memory they should not have access to, leading to a system crash or unauthorized data modification.
Technical details
A vulnerability in the amdgpu driver's user queue management (amdgpu_userq.c and mes_userqueue.c) allowed user-space applications to provide arbitrary virtual addresses for queue objects without proper validation against valid VM mappings. The root cause was the lack of residency checks for the userq object's virtual address and size. A local attacker with low privileges could provide malicious addresses for the queue, read pointer (rptr), write pointer (wptr), or shadow buffers, potentially leading to kernel memory corruption or information disclosure. The fix introduces amdgpu_userq_input_va_validate() to ensure all provided addresses reside within valid VM mapping ranges before queue creation proceeds.
Affected products
- Linux Linux Kernel 6.16 to 6.17.7
Timeline
- 2025-12-09: advisory: NVD Published Date
- 2025-11-13: patched: Commit 5a577de86c4a1c67ca405571d6ef84e65c6897d1 applied to stable tree