Executive brief
A vulnerability in the Linux kernel's AMD GPU driver could allow a local user to cause system instability. By providing invalid queue size parameters to the graphics driver, an attacker can trigger GPU faults or unexpected hardware behavior. This primarily impacts the availability of the system's graphics processing capabilities.
Technical details
A vulnerability exists in the amdgpu driver within the Linux kernel due to insufficient validation of user queue size constraints in 'amdgpu_userq.c'. Specifically, the driver failed to ensure that queue sizes were a power of two (required for ring buffer wrapping) and met the minimum 'AMDGPU_GPU_PAGE_SIZE' requirement. A local attacker with access to the DRM device can provide malformed input arguments to trigger invalid hardware configurations, leading to GPU faults or denial of service. The issue has been resolved by adding explicit checks in 'amdgpu_userq_input_args_validate'.
Affected products
- Linux Linux Kernel 6.16 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-03-04: patched