Executive brief
A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to corrupt kernel memory. The issue exists in how the driver handles requests to create hardware queues for graphics processing. An attacker with local access could exploit this to cause a system crash or potentially gain higher privileges, impacting the stability and security of the operating system.
Technical details
A vulnerability in amdgpu_userq_get_doorbell_index() within the Linux kernel's DRM subsystem allows for an out-of-bounds access. The function passes a user-provided 'doorbell_offset' to amdgpu_doorbell_index_on_bar() without performing bounds checking. An attacker can provide an arbitrarily large offset, causing the calculated index to fall outside the allocated doorbell Buffer Object (BO). This results in the corruption of kernel doorbell space. The fix introduces validation using u64 arithmetic to ensure the offset remains within the BO boundaries and prevents overflow. Patches are available in various stable kernel branches.
Affected products
- Linux Linux Kernel 6.16 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-05-01: disclosed
- 2026-05-01: advisory