Executive brief
A vulnerability was identified in the AMD GPU driver within the Linux kernel that could lead to improper memory access. The driver's video acceleration components (UVD, VCE, and VCN) were accessing internal buffers at fixed locations without verifying if the buffers were large enough. This could potentially lead to system instability or unauthorized access to kernel memory by a local user.
Technical details
A vulnerability in the Linux kernel's amdgpu driver exists due to missing bounds checking in the ib_get_value and ib_set_value functions within the uvd/vce/vcn code. These components accessed Indirect Buffers (IB) at predefined offsets without verifying the buffer length (length_dw). Additionally, the index variable was changed from a signed integer to uint32_t to prevent integer overflow vulnerabilities that could bypass subsequent bounds checks. An attacker with local access could potentially exploit this to perform out-of-bounds reads or writes in kernel space. The issue has been resolved by implementing explicit bounds checks and updating the index data type.
Affected products
- Linux Linux kernel uvd/vce/vcn components in amdgpu driver
Timeline
- 2026-03-25: other: Patch authored
- 2026-05-28: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53f
- https://git.kernel.org/stable/c/66085e206431ef88ce36f53c1f53d570790ccc9e
- https://git.kernel.org/stable/c/a853178d23e774adfe3a35073c375b04b3b20f7d
- https://git.kernel.org/stable/c/ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7
- https://git.kernel.org/stable/c/fec8b11b55e53ff51a741e56894fe331a516f5c6