Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdgpu) specifically affecting systems using Video Core Next (VCN) 4 hardware. The flaw involves an integer overflow during the processing of video decoder messages, which could allow a local user to bypass memory safety checks. If exploited, this could lead to system instability or unauthorized access to sensitive kernel memory.
Technical details
An integer overflow vulnerability exists in the 'vcn_v4_0_dec_msg' function within 'drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c'. The root cause is an insecure boundary check where 'offset + size' could overflow, bypassing the validation intended to prevent out-of-bounds (OOB) reads when parsing decoder messages. An attacker with local access to the DRM interface could provide specially crafted message offsets and sizes to trigger this overflow. The fix introduces 'check_add_overflow' to safely validate that the message buffer remains within the allocated Buffer Object (BO) bounds. Patches have been applied across multiple stable kernel branches.
Affected products
- Linux Linux Kernel VCN4-enabled versions prior to fixed releases in 2026
Timeline
- 2026-04-13: other: Patch authored by Benjamin Cheng
- 2026-05-28: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/271cd5429513ff9b364a9bf8903e5b65b687eb25
- https://git.kernel.org/stable/c/30d12ee310a6024ff4c7b9eafdbbeab2db450d4a
- https://git.kernel.org/stable/c/5bb5faff4837b1d98fd655cf8bd7b5d4da0fc4dc
- https://git.kernel.org/stable/c/65bce27ea6192320448c30267ffc17ffa094e713
- https://git.kernel.org/stable/c/73043d296787bf187d89ffb5c5dcf5bdc3db7885