Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-89818

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 88411caee8f576d6b5abf6531232fcc0ce756dc5 to < c2340281be4ddacb8c203e2bce59b126d1d6c4c8affected
  • c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e to < 6dceaeceaa7c8396339f3ea34b0110cb912ca61baffected
  • 7688143ca62edeecacb3ba0a2cea129dbd262a18 to < 47799e1f893d47d8af231710a61065e3ec8a13e8affected
  • 63b51e8a9d54317d31cc3856c1e12407070d5fc2 to < 7e28853c78c20bb8ba4c1dba702430cd05e09f76affected
  • b193019860d61e92da395eae2011f2f6716b182f to < 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3affected
  • b193019860d61e92da395eae2011f2f6716b182f to < 4d7390530853eb7befda9cc786e4c86e8ad7ac9eaffected
  • f55552adb100eb54a6e6dabff4fbdc8679bd3fa0affected
  • 82c535eff05490c71153af57de9fe85502fcb5d5affected
  • 638d3e0b9eb77aa53fdd60e2b928761d16ba76faaffected
  • 870c8738c3774336baedddd0240951d078a703b8affected
  • 638e48ee39d0f2af9336f917a6f5d6692dd64d93affected
  • e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7affected
  • 3c817a60b09eaab926e475088e750936efcc95aeaffected
  • 6.1.175 to < 6.1.188affected
  • 6.6.140 to < 6.6.157affected
  • 6.12.90 to < 6.12.110affected
  • 6.18.32 to < 6.18.51affected
  • 5.15.209 to < 5.16affected
  • 7.0.9 to < 7.1affected

Linux Linux

Default version status: affected

  • 7.1affected
  • 0 to < 7.1unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.51 to ≤ 6.18.*unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References