Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (specifically for VCN3 hardware) that could allow a local attacker to bypass memory safety checks. The issue occurs when the driver processes video decoding messages, where an integer overflow could lead to out-of-bounds memory access. This could potentially result in a system crash or unauthorized access to sensitive kernel memory.
Technical details
An integer overflow vulnerability exists in the 'vcn_v3_0_dec_msg' function within 'drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c' of the Linux kernel. The root cause is an insufficient bounds check where 'offset + size' could overflow, bypassing the validation against the buffer object (BO) limits. A local attacker with the ability to submit crafted video decoding messages to the AMDGPU driver can trigger this overflow to cause out-of-bounds (OOB) reads or writes. The fix introduces 'check_add_overflow' to safely validate the buffer boundaries. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel vcn3 component
Timeline
- 2026-04-13: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/016b64a0313ea5346cf526e30c8d3e66aca10175
- https://git.kernel.org/stable/c/1936310f68c54be961de38ac539cef9b543207cb
- https://git.kernel.org/stable/c/2e43b66fceacd6e982b94f2e3f8b34edd7463396
- https://git.kernel.org/stable/c/e6e9faba8100628990cccd13f0f044a648c303cf
- https://git.kernel.org/stable/c/e8124121b79ab5d32fa8fbbd101f7208eca9cd7d