Executive brief
A vulnerability in the Linux kernel's AMD graphics driver could allow a local user to crash the system. By providing excessively large input values to a specific graphics component, an attacker can trigger an 'Out of Memory' (OOM) condition. This results in a denial of service, potentially disrupting operations or causing data loss on the affected machine.
Technical details
A vulnerability exists in the amdgpu_userq_signal_ioctl function within the Linux kernel's DRM AMDGPU driver. The component failed to perform upper-bound checks on user-supplied handle counts (num_syncobj_handles, num_bo_write_handles, and num_bo_read_handles) before passing them to memory allocation functions like memdup_user. A local attacker with access to the DRM device can provide massive input values to trigger an Out of Memory (OOM) condition, leading to a kernel panic or system instability. The fix introduces a maximum limit (AMDGPU_USERQ_MAX_HANDLES) of 65,536 handles to ensure legitimate use cases are supported while preventing resource exhaustion.
Affected products
- Linux Linux Kernel 6.16 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1
Timeline
- 2026-02-20: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD analysis completed