Linux Kernel CVE-2026-31766

This vulnerability affects the AMD GPU kernel driver (amdgpu/DRM subsystem) in Linux, specifically the user queue doorbell management mechanism. Doorbells are hardware signaling constructs used for GPU-CPU communication-the GPU reads doorbell memory locations to detect work submissions. The vulnerable function amdgpu_userq_get_doorbell_index() accepts a user-controlled doorbell_offset parameter and passes it unchecked to amdgpu_doorbell_index_on_bar(), which calculates a BAR (Base Address Register) index into the doorbell buffer object (BO). Without bounds validation, an attacker-supplied offset can cause integer overflow in u64 arithmetic or simply reference memory beyond the allocated doorbell BO boundaries. Since kernel doorbells share proximity with user doorbells in GPU BAR space, this enables corruption of kernel-owned doorbell entries. The CPE identifiers indicate broad applicability across Linux kernel versions containing the amdgpu driver code path introduced in commit f09c1e6077ab. The fix (commit de1ef4ffd70e) adds explicit bounds checking using u64 arithmetic before index computation, ensuring doorbell_offset cannot exceed the allocated BO size.