Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver (amdgpu) specifically affecting the Video Codec Engine (VCE). This flaw could allow an incorrect memory address to be written to the device firmware when processing certain graphics commands. This could lead to system instability or unpredictable behavior on systems using AMD graphics hardware.
Technical details
A vulnerability exists in the `amdgpu_vce_cs_reloc` function within `drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c` of the Linux kernel. The issue arises when only one part (high or low) of a 64-bit address is valid during command stream relocation, which can result in a 'bad' or partial address being patched into the firmware. An attacker with the ability to submit crafted command streams to the GPU could potentially exploit this to cause firmware-level errors or memory corruption. The fix introduces bounds checking for the 'lo' and 'hi' offsets against the indirect buffer (IB) length to ensure both components are valid before patching. Patches have been backported to several stable kernel branches including 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.1.175, 6.6.140, 6.12.90, 6.18.32, 7.0.9
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/0ee17150763962671f43a62ddf8f6ea1feaff438
- https://git.kernel.org/stable/c/2d66d1f5d8c0434e9a5ad21cc6eaf3a5e32141d5
- https://git.kernel.org/stable/c/944db9cfa5373f67eb94621d4c2eee572c05fa3f
- https://git.kernel.org/stable/c/b3d1a0a45c4aec484fa2a5b060b611e3d3064470
- https://git.kernel.org/stable/c/de2a02cc28d6d5d37db07d00a9a684c754a5fd74
- https://git.kernel.org/stable/c/ea2c554e700b86a04534b4c24ece5844e8c5f07e