Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-80576

drm/amdgpu: reject oversized IBs with per-ring packet limits

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < ecdaefe825555f133a2ef80f39d1ae94d6e1b26aaffected
  • d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 67a5d905c17a5066b0f6f950da11da93d56d122baffected
  • d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 6e164ba1057175fb8a370d8e05cbff5c57eac0c8affected
  • d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 1474f3970d1afd303e12ff14d06808eabb371576affected
  • d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 07fe270ec07c138a70afe7a81e115a85c35c545caffected
  • d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < fd37f9dd5b5ab70a46fa7bc76623c0528d602b27affected

Linux Linux

Default version status: affected

  • 4.2affected
  • 0 to < 4.2unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.105 to ≤ 6.12.*unaffected
  • 6.18.46 to ≤ 6.18.*unaffected
  • 7.1.10 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References