Executive brief
A vulnerability in the AMD graphics driver for Linux could allow a local user to crash the system. By providing excessively large input values to a specific graphics queue function, an attacker can trigger an 'Out of Memory' (OOM) condition. This results in a denial of service, potentially disrupting operations or causing data loss on the affected machine.
Technical details
The vulnerability exists in the amdgpu_userq_wait_ioctl function within the Linux kernel's DRM subsystem for AMD GPUs. It is caused by a lack of upper-bound validation on user-supplied input values for syncobj and buffer object (BO) handles. A local attacker with access to the GPU device can provide extremely large handle counts, causing the kernel to attempt excessive memory allocations via memdup_user, leading to an Out of Memory (OOM) state. The fix introduces a check against AMDGPU_USERQ_MAX_HANDLES to ensure input values remain within safe limits.
Affected products
- Linux Linux Kernel 6.16 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1
Timeline
- 2026-02-24: other: Vulnerability fixed in source code by Sunil Khatri
- 2026-05-08: disclosed: CVE published by kernel.org
- 2026-05-08: advisory