Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdgpu) specifically affecting Video Core Next (VCN) 3.0 hardware. The flaw allows for out-of-bounds memory reads when the system processes certain video decoding messages. This could potentially lead to system instability or the exposure of sensitive kernel memory to local users.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the 'vcn_v3_0_dec_msg' function within 'drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c'. The issue stems from insufficient bounds checking when parsing decoder messages stored in Buffer Objects (BO). Specifically, the driver failed to verify that the message header, the number of buffers, and the buffer indices fit within the allocated memory range. An attacker with the ability to submit crafted video decoding jobs could trigger reads beyond the intended buffer. The fix introduces multiple checks to ensure the message is at least 4 DWORDs long and that all claimed buffer indices reside within the valid memory bounds of the BO.
Affected products
- Linux Linux Kernel vcn3 driver versions prior to 2026-05-28 patches
Timeline
- 2026-03-24: other: Patch authored by Benjamin Cheng
- 2026-05-28: advisory: CVE-2026-46230 published by NVD
- 2026-05-28: patched: Patches merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/638d3e0b9eb77aa53fdd60e2b928761d16ba76fa
- https://git.kernel.org/stable/c/638e48ee39d0f2af9336f917a6f5d6692dd64d93
- https://git.kernel.org/stable/c/870c8738c3774336baedddd0240951d078a703b8
- https://git.kernel.org/stable/c/b193019860d61e92da395eae2011f2f6716b182f
- https://git.kernel.org/stable/c/e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7