Executive brief
A vulnerability was identified in the Linux kernel's AMD display driver component. An error in how memory is allocated for internal data structures could allow a malicious actor to cause a system crash or potentially execute unauthorized code. This issue affects systems using AMD graphics hardware and has been resolved in recent kernel updates.
Technical details
A heap overflow vulnerability exists in the dal_vector_reserve() function within the Linux kernel's AMD display driver (drivers/gpu/drm/amd/display/dc/basics/vector.c). The function calculated allocation sizes using 32-bit unsigned integer arithmetic (capacity * vector->struct_size) without overflow checks. When an overflow occurred, krealloc() would allocate a buffer significantly smaller than required, leading to a heap-based buffer overflow during subsequent data appends. The fix replaces krealloc() with krealloc_array(), which includes built-in overflow detection. This vulnerability is reachable locally and could be leveraged for denial-of-service or local privilege escalation.
Affected products
- Linux Linux Kernel 4.15 to 6.13.y
Timeline
- 2026-05-05: other: Vulnerability fixed in upstream source code
- 2026-06-19: patched: Patches committed to various stable kernel branches
- 2026-07-01: disclosed: CVE published
References
- https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b
- https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211
- https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34
- https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13
- https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009
- https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870
- https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d