Executive brief
A vulnerability in the Linux kernel's AMD graphics driver could allow a local user to crash the system or cause significant slowdowns. By requesting an extremely large number of buffer objects, an attacker can force the system to exhaust its available memory. This results in a denial-of-service condition, impacting the availability of the affected machine.
Technical details
A resource exhaustion vulnerability exists in the amdgpu driver within the Linux kernel. The 'amdgpu_bo_create_list_entry_array' function in 'amdgpu_bo_list.c' allowed userspace to provide an arbitrary 'bo_number' value. While existing checks prevented integer overflows during allocation, they did not prevent valid but excessively large allocations that could consume gigabytes of system memory. An attacker with local access could exploit this to trigger an Out-of-Memory (OOM) condition or cause long kernel processing times. The fix introduces a hard limit of 128k entries (AMDGPU_BO_LIST_MAX_ENTRIES) per BO list.
Affected products
- Linux Linux Kernel amdgpu driver
Timeline
- 2026-04-03: disclosed: Initial publication of the vulnerability record.
- 2026-03-17: patched: Mainline kernel patch committed.
References
- https://git.kernel.org/stable/c/2723e6851309531ce61aed74e93a0cd268cc862a
- https://git.kernel.org/stable/c/5ce4a38e6c2488949e373d5066303f9c128db614
- https://git.kernel.org/stable/c/6270b1a5dab94665d7adce3dc78bc9066ed28bdd
- https://git.kernel.org/stable/c/e620378aab78d415bd8a15a2f91c145906520288
- https://git.kernel.org/stable/c/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9