Skip to main content

Linux Kernel CVE-2026-46204

| EUVDEUVD-2026-32831 HIGH
Out-of-bounds Read (CWE-125)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-2hxx-m8v6-fcm5
Linux Information Disclosure Buffer Overflow
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 30, 2026 - 12:05 vuln.today
CVSS changed
May 30, 2026 - 11:22 NVD
7.1 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn4: Prevent OOB reads when parsing IB

Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks.

AnalysisAI

Out-of-bounds read in the Linux kernel's AMD GPU VCN4 (Video Core Next) driver allows a local user with GPU access to trigger memory disclosure or denial of service by submitting a crafted indirect buffer (IB) to the amdgpu DRM subsystem. The flaw stems from missing bounds checks while parsing IBs in the drm/amdgpu/vcn4 code path, and no public exploit identified at time of analysis. EPSS exploitation probability is very low (0.02%) and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the amdgpu kernel DRM driver supporting AMD's Video Core Next 4 (VCN4) hardware block, which performs video encode/decode acceleration on recent Radeon and Instinct GPUs. User-space clients submit work to the GPU through Indirect Buffers (IBs) that the kernel must parse before dispatch; the original VCN4 IB parser indexed into the buffer directly without validating offsets against the IB length, producing an out-of-bounds read class issue (CWE-125-style, though the CVE entry lists CWE as N/A). The fix replaces direct indexing with amdgpu_ib_get_value(), a helper that performs bounds checks against the IB size before returning each dword, preventing reads past the buffer.

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.140, 6.12.90, 6.18.32, 7.0.9, or 7.1-rc1 or later depending on the stable branch in use, pulling the fix from any of the linked git.kernel.org stable commits (e.g., 1dc005775fb5b3f86464406452b17364f85581d3). Distribution users should apply the next kernel update from their vendor (RHEL, Ubuntu, SUSE, Debian, Oracle) once the backport is published. If immediate patching is not possible, compensating controls include restricting access to /dev/dri/renderD* device nodes by removing untrusted users from the render and video groups (side effect: those users lose hardware video decode/encode acceleration), disabling VCN4 hardware video decode in user-space clients such as Mesa/VA-API (side effect: video playback falls back to CPU decoding with higher load), or, in container and multi-tenant hosts, refusing to pass through the amdgpu render node to untrusted workloads.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-46204 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy