Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver specifically affecting the Video Codec Engine (VCE) 1.0 component. This component is responsible for video encoding tasks on certain AMD graphics hardware. An error in how the system calculates memory sizes for the device's firmware could lead to out-of-bounds memory access, potentially causing system instability or crashes.
Technical details
A vulnerability in the `drm/amdgpu/vce1` driver stems from incorrect calculation of the VCPU Buffer Object (BO) size and offsets. Specifically, the firmware (FW) resides at an offset within the BO, but this offset was not accounted for in the total size calculation, creating a risk of out-of-bounds access during memory operations. Additionally, the driver lacked proper alignment for stack and data offsets relative to the 32K TLB size and failed to verify if the microcode fit within its reserved space. An attacker with local access could potentially exploit this to cause a kernel panic or memory corruption. The fix introduces proper size subtraction for offsets, enforces 32K alignment, and adds bounds checking for the microcode size.
Affected products
- Linux Linux Kernel 6.19, 7.0.11, 7.1
Timeline
- 2026-07-25: disclosed: CVE published by kernel.org
- 2026-07-25: advisory: NVD record created