Executive brief
The AMDGPU graphics driver in the Linux kernel contains an input validation flaw in its GEM buffer creation interface that allows userspace to provide invalid memory domain combinations. This can cause the kernel to crash (denial of service) when processing malformed requests from GPU applications or attackers with local system access.
Technical details
The AMDGPU_GEM_CREATE ioctl in drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c failed to validate domain combination constraints. Userspace could combine normal domains (CPU, GTT, VRAM) with special domains (DOORBELL, GDS, GWS, OA), causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and trigger a BUG_ON() crash. The fix introduces amdgpu_gem_are_domains_valid() to enforce that normal domains can only be combined with each other, and special domains must be specified individually, returning -EINVAL for invalid combinations. Attack vector requires local access and ability to issue ioctl calls (unprivileged userspace in many configurations). A patch has been merged into the stable Linux kernel tree.
Affected products
- Linux Linux kernel Multiple versions (patch backported across linux-5.x and linux-6.x stable branches)
Timeline
- 2026-08-26: disclosed: CVE-2026-80541 published
- 2026-07-27: patched: Upstream fix committed by Candice Li
- 2026-08-23: patched: Backported to stable kernel branches