Executive brief
The Linux kernel's AMD GPU driver contains a buffer size calculation vulnerability in the Video Codec Engine (VCE) component. Malicious GPU command streams with oversized image dimensions can trigger a 32-bit integer overflow, causing the calculated buffer size to wrap to zero and bypass security validation. This allows GPU firmware to access out-of-bounds memory, potentially enabling privilege escalation or system compromise.
Technical details
The vulnerability is a 32-bit integer overflow in the DRM AMDGPU VCE driver's image size calculation (drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c). When processing VCE command streams, width and height dimensions are multiplied without overflow checking: `width * height * 8 * 3 / 2`. Oversized dimensions (e.g., 65536×65536) cause this calculation to wrap to zero in 32-bit arithmetic, bypassing validation. An attacker can craft malicious VCE commands locally to trigger this overflow. The fix implements dimension validation (max 4096×2304) and uses proper integer handling to reject invalid sizes before hardware processing. The patch is available in Linux stable kernels and addresses the upstream commit cbe408dba581755ad1279a487ec786d8927d778d.
Affected products
- Linux Linux kernel Multiple versions (patch available in stable branches)
Timeline
- 2026-08-10: disclosed: Published as CVE-2026-68108
- 2026-05-25: patched: Upstream fix committed by Boyuan Zhang
- 2026-08-03: patched: Stable kernel backport by Greg Kroah-Hartman