EUVD-2026-59564
GHSA-h36j-68r7-9j5g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DRM ioctl vector (AV:L), low-privilege account required (PR:L), no interaction needed; C/I/A:H reflects worst-case kernel heap corruption and privilege escalation potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix integer overflow in radeon_align_pitch()
radeon_align_pitch() has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned * cpp' calculation can overflow signed int.
If that wraps, radeon_mode_dumb_create() can end up returning an invalid pitch or creating a zero-sized dumb buffer.
Fix this by using check_add_overflow() for the alignment round-up and check_mul_overflow() for the final pitch calculation, returning 0 on overflow. Also reject zero pitch and size in radeon_mode_dumb_create().
Found via AST-based call-graph analysis using sqry.
AnalysisAI
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must have a legacy ATI/AMD Radeon GPU with the radeon kernel DRM module loaded and active - this driver covers pre-GCN and early-GCN era hardware and is distinct from the modern amdgpu driver. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a realistic local threat: any user with DRM device node access can trigger the overflow without elevated privileges or user interaction, and with low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a shared Linux system with a legacy Radeon GPU (e.g., an old workstation or thin client) issues a DRM_IOCTL_MODE_CREATE_DUMB ioctl with a crafted width and bytes-per-pixel combination selected to wrap the signed integer arithmetic in radeon_align_pitch(), causing the kernel to allocate a zero-sized or dramatically undersized heap buffer. The attacker then writes data into the buffer, overflowing into adjacent kernel heap objects and building a memory corruption primitive that can be chained to overwrite function pointers or other sensitive kernel structures for privilege escalation to root. … |
| Remediation | Apply the patched kernel release for the appropriate stable branch: upgrade to 6.6.145, 6.12.97, 6.18.40, or 7.1.5 as applicable; mainline users should target 7.2-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with ATI/AMD Radeon GPU drivers to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today