Executive brief
The Linux kernel's AMD GPU driver contains an integer overflow vulnerability in its video codec (VCN) message parsing logic. An attacker could exploit this to read memory beyond the intended buffer boundaries, potentially exposing sensitive kernel data or causing a system crash. This affects systems using AMD GPUs with the vulnerable kernel versions.
Technical details
The vulnerability is an integer overflow in the VCN (Video Core Next) message parser, specifically in the dec_msg buffer count validation in vcn_v3_0 and vcn_v4_0 drivers. The original check used the expression `6 + num_buffers * 4 > len_dw`, which wraps around when `num_buffers` is set to 0x3FFFFFFF, causing the calculation to overflow and pass validation despite being invalid. An attacker supplying a malicious message with this buffer count value can bypass the bounds check and read far past the intended message buffer object. Exploitation requires a ~4GiB kernel mapping and local access to submit GPU commands. The fix rewrites the validation using division form (`num_buffers > (len_dw - 6) / 4`), which is mathematically overflow-free. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions (patches applied to linux-4.x through linux-7.x stable trees and mainline)
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-08-07: patched: Upstream commit 4d7390530853eb7befda9cc786e4c86e8ad7ac9e merged
- 2026-09-14: patched: Backported to stable releases via commit 47799e1f893d47d8af231710a61065e3ec8a13e8