Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-68108

drm/amdgpu/vce: fix integer overflow in image size

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access. The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware. V2: remove redundant check V3: modify max height value V4: remove size64 (cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to < 893db20383800cfe92e638705984eebb13bc81a5affected
  • f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to < a07430abd556de3707adfcadcc60db3fa64e4b2baffected
  • f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to < a6d7065b91a14790980ce6f4960db0ca8c3c9940affected
  • f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to < 7eebef042c12dfe0568593ee6a8926d16505925eaffected
  • f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to < 00c311a13d225266800c712f2b7db2711c6897deaffected
  • f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to < 186bfdc4e26d019b2e7570cb121964a1d89b2e5baffected

Linux Linux

Default version status: affected

  • 4.2affected
  • 0 to < 4.2unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.148 to ≤ 6.6.*unaffected
  • 6.12.101 to ≤ 6.12.*unaffected
  • 6.18.42 to ≤ 6.18.*unaffected
  • 7.1.6 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References